Live › vulnerability › CVE-2026-13747
The Meow Gallery plugin for WordPress fails to check user permissions on one action, letting an author-level account list private and draft posts. An attacker gets post IDs, titles, dates, authors and status for posts they should not see, including other users' drafts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the Meow Gallery WordPress plugin version 5.5.4 or older that have accounts with Author level or above. Sites without the plugin, or where only administrators and editors have accounts, are less exposed. The sources do not say whether the flaw depends on any particular setting.
No product ranges from the sources yet.
wp plugin get meow-gallery --field=version if WP-CLI is available.5.5.4 (the sources do not name the exact fixed release).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-13747")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.