---
id: "CVE-2026-13747"
kind: "vulnerability"
aliases: ["CVE-2026-13747"]
title: "WordPress Meow Gallery plugin: authors can read private and draft post metadata"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["meow-gallery", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-author-accounts", "plugin-not-installed"]
published_at: "2026-10-30T18:17:28+00:00"
first_seen_at: "2026-10-30T18:55:30+00:00"
updated_at: "2026-10-30T18:56:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13747", "first_seen_at": "2026-10-30T18:55:30+00:00"}]
---

# WordPress Meow Gallery plugin: authors can read private and draft post metadata

The Meow Gallery plugin for WordPress fails to check user permissions on one action, letting an author-level account list private and draft posts. An attacker gets post IDs, titles, dates, authors and status for posts they should not see, including other users' drafts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Meow Gallery plugin version in the WordPress admin under Plugins, or with `wp plugin get meow-gallery --field=version` if WP-CLI is available.
- Confirm whether any site users hold the Author role or higher.

## Fix

- Move the Meow Gallery plugin to a version later than `5.5.4` (the sources do not name the exact fixed release).

## Timeline

- 2026-10-30T18:55:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13747

## From the sources

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_