Meow Gallery CVE-2026-13747

Requires an authenticated WordPress account with author-level privileges or above on a site running Meow Gallery 5.5.4 or earlier; it works against default configurations (no special feature toggle or non-default setting is called out in the sources). Limiting factors: the PR:L requirement means an anonymous or subscriber-level user cannot exploit it, so the attacker must already possess or compromise an author+ account; no user interaction is needed (UI:N); and the impact is confined to reading metadata (ID, title, date, author, status) of private and draft posts rather than their full content or any write/modification capability.

This is a medium-severity authorization flaw (CVSS 6.5 per Wordfence) whose real-world urgency is moderate rather than critical. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N is network-reachable and low-complexity, but PR:L means exploitation requires an authenticated account with author-level privileges or above - a meaningful trust barrier that excludes anonymous internet attackers and limits the realistic attacker population to existing site users (e.g., contributors/authors on multi-author blogs or any account that has been provisioned or compromised at that level). The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a plan-and-patch posture. No CISA KEV listing is present and no EPSS probability was supplied, so there is no signal of active or widespread exploitation; exploitation status is best described as no public working exploit identified. One signal to weigh carefully: the input rates confidentiality as C:H, but the disclosed data is metadata only (post ID, title, date, author, status) of private/draft posts - not full post content - which I assess as a Low rather than High confidentiality impact; verify the intended scope with Wordfence if the distinction matters to prioritization. Net: a genuine but bounded information-disclosure issue, appropriate for routine patching within the month rather than emergency response.

An attacker who already holds an author-level (or higher) account on the WordPress site - for example a contributor on a multi-author blog, or an account obtained through credential compromise - sends requests to the Meow Gallery plugin's REST endpoints, which fail to verify that the caller is authorized for the action. This lets them enumerate and read metadata (post ID, title, date, author, status) of all private and draft posts site-wide, including drafts authored by other users. No confirmed public working exploit code was identified; the available references point to the plugin source and the patch changeset rather than to a published PoC.