Medium 6.5

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to...

CVE-2026-13747 First seen on SecPulse 02:15

Affected packages

Ecosystem	Package	Affected	Fixed
tigroumeow	Meow Gallery	≤ 5.5.4	—

Original description The description as published by the source.

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.5; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: Oct 31, 2026
First seen on SecPulse: 02:15
GHSA: GHSA-jxc5-78m4-q5w9
CWE: CWE-862

NVD GitHub Advisory

Tags(click for explanation)

Web Frameworks

WordPress

CWE

CWE-862

All

Tigroumeow Meow Gallery

Detection sources

NIST National Vulnerability Database03:33
GitHub Security Advisories (Global)03:32
CVE.org (CVE Program・cvelistV5)02:26