What the vulnerability does
01Description
The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the REST API endpoint /wp-json/meow-gallery/v1/save_shortcode in all versions up to, and including, 5.4.4 This makes it possible for authenticated attackers, with Author-level access and above, to arbitrarily create or overwrite existing gallery shortcode records by supplying a user-controlled id value. The endpoint performs database update operations without verifying that the requesting user is authorized to modify the referenced gallery record or create their own.
Explanation of Vulnerability in Simple Terms
02Summary
Meow Gallery versions 5.4.4 and earlier contain an integrity vulnerability that allows authenticated users to modify data on the site. The vulnerability requires a valid user account and network access but does not require user interaction. No confidentiality or availability impact is present. Site administrators should update to a version newer than 5.4.4.
What an attacker can do
03Attacker Capabilities
Modify data on the site with a valid user account.
Potential impact on your site
04Site Impact
Authenticated users can alter site content or settings without authorization.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account; no user interaction required.
Key dates
06Disclosure timeline
June 13, 2026
CVE published
June 15, 2026
Record updated
