Meow Gallery EUVD-2026-36649

Exploitation requires a valid WordPress user account with Author role or higher on the target site. The Meow Gallery plugin must be installed, active, and running version 5.4.5 or earlier. The attacker must be able to authenticate to the WordPress REST API (standard cookie or application password authentication). No special server configuration, non-default plugin settings, or network-level access beyond HTTPS to the WordPress site is required - the vulnerable endpoint is active by default once the plugin is installed. Exploitation is limited by the authentication barrier: unauthenticated users cannot reach the endpoint. The practical threat actors are malicious insiders, compromised Author accounts, or platforms allowing public Author-level registration. There is no unauthenticated exploitation path, and no evidence of exploitation by external network attackers without prior credential access.

CVSS 3.1 scores this at 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The PR:L metric is the critical limiting factor: exploitation requires a valid WordPress account with at least Author role, which is not the same as arbitrary unauthenticated access. On single-author or tightly controlled WordPress installations, risk is low. On news sites, multi-author blogs, or platforms that allow public user registration with Author roles, the risk is materially higher because any contributor could tamper with any other user's gallery records. No EPSS data was provided in the input; no CISA KEV listing exists; no public POC has been identified. SSVC signals: exploitation status is not active, the attack is not automatable at scale (requires per-site authentication), and technical impact is partial integrity. The net assessment is a real but bounded risk - elevated for multi-contributor WordPress deployments, negligible for sites where Author accounts are restricted.

An attacker who holds a WordPress Author account (obtained via legitimate registration, phishing, or credential stuffing) authenticates to the site and sends a crafted POST request to /wp-json/meow-gallery/v1/save_shortcode with a known or enumerated id value belonging to a gallery record owned by another user, such as an editor or administrator. The plugin performs the database write without ownership verification, allowing the attacker to overwrite the victim's gallery shortcode content - potentially injecting malicious HTML or breaking site content. No public POC has been identified, but the attack requires only standard authenticated REST API calls and is low in complexity.