{"id":"CVE-2026-13747","kind":"vulnerability","aliases":["CVE-2026-13747"],"related":[],"title":"WordPress Meow Gallery plugin: authors can read private and draft post metadata","description":"The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.","summary":"The Meow Gallery plugin for WordPress fails to check user permissions on one action, letting an author-level account list private and draft posts. An attacker gets post IDs, titles, dates, authors and status for posts they should not see, including other users' drafts.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meow-gallery","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-author-accounts","plugin-not-installed"],"how_to_check":"- Check the installed Meow Gallery plugin version in the WordPress admin under Plugins, or with `wp plugin get meow-gallery --field=version` if WP-CLI is available.\n- Confirm whether any site users hold the Author role or higher.","fix":"- Move the Meow Gallery plugin to a version later than `5.5.4` (the sources do not name the exact fixed release).","status":"open","published_at":"2026-10-30T18:17:28+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","triaged_at":"2026-10-30T18:56:57+00:00","updated_at":"2026-10-30T18:56:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:56:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Meow Gallery plugin to a version later than `5.5.4` (the sources do not name the exact fixed release).","reach":"internet","title":"WordPress Meow Gallery plugin: authors can read private and draft post metadata","impact":"low","summary":"The Meow Gallery plugin for WordPress fails to check user permissions on one action, letting an author-level account list private and draft posts. An attacker gets post IDs, titles, dates, authors and status for posts they should not see, including other users' drafts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","meow-gallery","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Author-level account reads metadata of other users' private and draft posts","analyst_note":"","how_to_check":"- Check the installed Meow Gallery plugin version in the WordPress admin under Plugins, or with `wp plugin get meow-gallery --field=version` if WP-CLI is available.\n- Confirm whether any site users hold the Author role or higher.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-author-accounts"],"who_is_affected":"Sites running the Meow Gallery WordPress plugin version 5.5.4 or older that have accounts with Author level or above. Sites without the plugin, or where only administrators and editors have accounts, are less exposed. The sources do not say whether the flaw depends on any particular setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4169,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-13747':15A,18A '-2026':14A,17A '5.5.4':93C 'access':123C 'account':49B 'action':43B,111C 'attack':56B,118C 'authent':117C 'author':5A,47B,62B,84C,107C,121C,136C,150C 'author-level':46B,120C 'bypass':85C 'check':38B 'cve':13A,16A 'date':61B,135C 'draft':10A,53B,74B,143C 'due':96C 'enumer':127C 'fail':36B 'galleri':3A,21B,32B,77C 'get':57B 'host':25B 'id':59B,133C 'includ':71B,92C,131C,148C 'let':44B 'level':48B,122C 'list':50B 'make':113C 'meow':2A,20B,31B,76C 'meow-galleri':19B 'metadata':12A,130C 'one':42B 'packag':22B 'perform':109C 'permiss':40B 'plugin':4A,29B,33B,78C,99C 'possibl':115C 'post':11A,54B,58B,66B,132C,144C 'privat':8A,51B,141C 'proper':101C 'read':7A,129C 'see':70B 'self':24B 'self-host':23B 'site':147C 'status':64B,138C 'titl':60B,134C 'user':39B,73B,105C,153C 'verifi':102C 'version':88C 'vulner':82C 'wordpress':1A,26B,28B,35B,80C 'wordpress-plugin':27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Meow Gallery WordPress plugin version 5.5.4 or older that have accounts with Author level or above. Sites without the plugin, or where only administrators and editors have accounts, are less exposed. The sources do not say whether the flaw depends on any particular setting.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13747","severity":null,"published_at":"2026-10-30T18:17:28+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","fetched_at":"2026-10-30T18:55:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}