CVE-2026-1291: Meow Gallery WordPress Plugin Authorization Bypass in REST API

Technical summary

CVE-2026-1291 is an authorization bypass vulnerability affecting the Meow Gallery WordPress plugin up to version 5.4.4. The REST API endpoint /wp-json/meow-gallery/v1/save_shortcode lacks capability verification before performing database UPDATE operations. The vulnerability stems from absent authorization checks on user-supplied id parameters, enabling authenticated attackers with Author role or higher to modify gallery shortcode records belonging to other users or create records outside their intended scope. The CWE classification (CWE-639) indicates improper authorization of a critical security function.

Business impact

For WordPress site operators, this vulnerability creates a risk of unauthorized modification of visual content and potential injection of malicious gallery shortcodes. On multi-author sites, an author could alter galleries created by others, disrupt intended site design, or inject shortcodes pointing to external or malicious content. While direct remote code execution is not possible through this flaw alone, compromised gallery records could be leveraged as part of a larger attack chain, particularly if shortcodes can reference arbitrary URLs or execute unvalidated callbacks.

Affected systems

Meow Gallery plugin for WordPress, versions 5.4.4 and all earlier versions. The vulnerability requires the attacker to be an authenticated WordPress user with at least Author-level capabilities. Sites using Meow Gallery with multiple authors or contributor accounts face elevated risk, as do installations where user access controls are permissive.

Exploitability

Exploitability is moderate. An attacker must already have valid WordPress credentials at Author level or above, which requires either legitimate access that is then abused, or credential compromise. Network access is required, but authentication is already satisfied by WordPress login. The REST endpoint is publicly accessible once authenticated, making exploitation straightforward via direct API calls. No user interaction is required beyond the attacker's initial authentication. This is not a zero-day and does not appear on CISA's Known Exploited Vulnerabilities list.

Remediation

Update Meow Gallery to a patched version released after June 17, 2026. Site administrators should verify the vendor's advisory for the specific version number addressing this flaw. As an interim measure, restrict REST API access via Web Application Firewall (WAF) rules targeting /wp-json/meow-gallery/v1/save_shortcode, or use WordPress security plugins to limit REST API access to trusted roles only. Review user access levels and remove unnecessary Author or Editor roles from accounts.

Patch guidance

Consult the Meow Gallery vendor advisory published after June 17, 2026, for the exact patched version number. Once available, test the update in a staging environment before deploying to production. Verify that gallery shortcodes are preserved and function correctly post-update. After patching, review recent activity logs to identify any unauthorized gallery modifications during the window of exposure.

Detection guidance

Monitor REST API logs for POST or PUT requests to /wp-json/meow-gallery/v1/save_shortcode, particularly those originating from unexpected user accounts or IPs. Flag requests where the 'id' parameter differs from galleries typically created by that user. Review WordPress post meta and shortcode records for galleries with unexpected modification timestamps or ownership. Query WordPress user roles and permissions to identify users with Author access who should not have it. Examine site backups from before the vulnerability was disclosed to establish baseline gallery content and detect unauthorized additions.

Why prioritize this

This vulnerability merits timely remediation due to its combination of easy exploit mechanics (REST API call with known endpoint), presence of authenticated access as a prerequisite, and potential for multi-author environments to suffer content tampering. Although CVSS 4.3 (MEDIUM) reflects the requirement for prior authentication, the low barrier to exploitation once credentials are obtained, and the likelihood of multi-user WordPress sites, justifies prompt patching. Priority is highest for sites with high editorial traffic or galleries serving as primary content delivery mechanisms.

Risk score, explained

CVSS 4.3 reflects a MEDIUM severity rating because the vulnerability requires low-privilege authentication (Author role) and causes only integrity impact (modification of shortcodes) with no confidentiality or availability consequences. The low complexity, network-accessible vector, and lack of user interaction keep the score moderate. However, the real-world risk is elevated on multi-author sites where content integrity and least-privilege access control are critical business requirements.

Frequently asked questions