PT-2026-49090 · Tigroumeow · Meow Gallery

Chawabhon Netisingha · Published 2026-06-13 · Updated 2026-06-13 · CVE-2026-1291

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the REST API endpoint /wp-json/meow-gallery/v1/save shortcode in all versions up to, and including, 5.4.4 This makes it possible for authenticated attackers, with Author-level access and above, to arbitrarily create or overwrite existing gallery shortcode records by supplying a user-controlled id value. The endpoint performs database update operations without verifying that the requesting user is authorized to modify the referenced gallery record or create their own.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1291

Affected Products

Meow Gallery

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-1291 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3386ea07-9c61-4b54-a451-1178ca6325cb?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3469543/meow-gallery/trunk/classes/rest.php · Note
• https://wordpress.org/plugins/meow-gallery · Note
• https://plugins.trac.wordpress.org/changeset/3469543/meow-gallery · Note
• https://plugins.trac.wordpress.org/browser/meow-gallery/trunk/classes/rest.php · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fmeow-gallery/tags/5.4.4&new_path=%2Fmeow-gallery/tags/5.4.5 · Note