Meow Gallery returns metadata for other users' private posts
An Author or higher role can retrieve titles, authors, dates and statuses of other users' draft and private posts because the read path lacks a proper capability check and requester-owned result restriction. The export does not disclose the route or establish full post-body disclosure. Authoritative affected range: < 5.5.5. Confirmed remediation: 5.5.5.
- Component
- Meow Gallery
- Plugin slug
meow-gallery- Affected
- < 5.5.5
- Safe version
5.5.5- Published
- Sep 20, 2026
This CVE was published Sep 20, 2026 and is one of 8 known issues for this plugin.
Update, patch or deactivate.
Update to the applicable fixed release identified in the authoritative export: 5.5.5. Apply per-post read permissions and visibility filters before selecting and serializing results. Restrict the affected post lookup until updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N