PT-2026-23132 · WordPress · Apocalypse Meow

Louis Deschanel · Published 2026-03-05 · Updated 2026-03-08 · CVE-2026-3523

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apocalypse Meow plugin for WordPress versions prior to 22.1.0

Description The software is susceptible to SQL injection through the type parameter. A flawed logical operator in the type validation check allows attacker-controlled single quotes to pass unescaped into SQL queries. This enables authenticated attackers with Administrator-level access or higher to append additional SQL queries, potentially extracting sensitive information from the database. The issue stems from an incorrect use of the '&&' (AND) operator instead of '||' (OR) in the validation process, causing the in array() validation to be bypassed. The stripslashes deep() function further contributes to the issue by removing wp magic quotes() protection.

Recommendations Update the Apocalypse Meow plugin to version 22.1.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3523

Affected Products

Apocalypse Meow

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-3523 · Security Note
• https://t.me/cveNotify/154270 · Telegram Post
• https://plugins.trac.wordpress.org/browser/apocalypse-meow/trunk/lib/blobfolio/wp/meow/ajax.php#L167 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a1af9757-23e9-41d2-bbcd-15b0610b6538?source=cve · Note
• https://twitter.com/CVEnew/status/2030755412807487939 · Twitter Post
• https://plugins.trac.wordpress.org/browser/apocalypse-meow/tags/22.1.0/lib/blobfolio/wp/meow/ajax.php#L167 · Note
• https://plugins.trac.wordpress.org/browser/apocalypse-meow/trunk/lib/blobfolio/wp/meow/ajax.php#L261 · Note
• https://plugins.trac.wordpress.org/browser/apocalypse-meow/trunk/lib/blobfolio/wp/meow/ajax.php#L101 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3448958%40apocalypse-meow&new=3448958%40apocalypse-meow&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/apocalypse-meow/trunk/lib/blobfolio/wp/meow/ajax.php#L298 · Note
• https://plugins.trac.wordpress.org/browser/apocalypse-meow/tags/22.1.0/lib/blobfolio/wp/meow/ajax.php#L298 · Note
• https://t.me/CVEtracker/46409 · Telegram Post
• https://plugins.trac.wordpress.org/browser/apocalypse-meow/tags/22.1.0/lib/blobfolio/wp/meow/ajax.php#L261 · Note
• https://plugins.trac.wordpress.org/browser/apocalypse-meow/tags/22.1.0/lib/blobfolio/wp/meow/ajax.php#L101 · Note