The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 6.5 · tigroumeowNVD modified 2026-10-30 17:26
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1f35d2c6-b631-40ba-b92a-972a891d4623?source=cve
- https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.5.1/classes/rest.php#L622
- https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.5.1/classes/rest.php#L123
- https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.5.1/classes/core.php#L77
- https://plugins.trac.wordpress.org/changeset?old_path=/meow-gallery/tags/5.5.4&new_path=/meow-gallery/tags/5.5.5