EUVD-2026-83675
GHSA-vwxr-fxpw-rxvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public plugin endpoint
-
ExploitInject value into shortcode string
-
ExecutionWP parser executes registered shortcodes
-
ImpactDisclose non-public gallery content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | No special conditions beyond having the vulnerable Meow Gallery plugin (any version before 5.5.5) installed and active on a WordPress site - the vulnerable endpoint is publicly reachable and requires no authentication or user interaction. The realistic limit on impact is scope of harm rather than access: the attacker can only invoke shortcodes ALREADY registered on the target site, and confidentiality damage is limited to non-public gallery content the shortcode parser can render; there is no code execution or availability impact. |
| Impact | This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction against a publicly reachable endpoint - the highest-reach attack surface possible. However, the impact metrics (C:L/I:L/A:N) correctly cap the severity: the flaw enables execution of already-REGISTERED shortcodes and disclosure of non-public gallery content, not arbitrary code execution. A public POC exists (WPScan), which raises practical risk and lowers the bar for opportunistic scanning, but this is distinct from active exploitation - there is no CISA KEV listing and no EPSS score in the provided data, so widespread automated exploitation is unconfirmed. Note a data conflict: the input Tags include 'RCE', but the description and the C:L/I:L/A:N impact vector do NOT support remote code execution - treat this as shortcode injection / information disclosure, not RCE. Overall: real and worth patching promptly given unauth reach + public POC, but the bounded impact keeps it below critical. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's publicly reachable endpoint, supplying a value that is concatenated unsanitized into a shortcode string. The WordPress shortcode parser then executes attacker-chosen registered shortcodes, allowing the attacker to render and read non-public gallery content they should not have access to. A public proof-of-concept is available from WPScan, lowering the effort required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Unauthenticated attackers can invoke arbitrary registered shortcodes on WordPress sites running the Meow Gallery plugin before version 5.5.5, due to insufficient sanitization of a user-supplied value concatenated into a shortcode string on a publicly reachable endpoint. This allows disclosure of non-public gallery content, but does not permit code execution or availability impact; publicly available exploit code exists, and the vendor has released a patch (5.5.5).
RemediationAI
Vendor-released patch: 5.5.5. Upgrade the Meow Gallery plugin to version 5.5.5 or later to fix the vulnerability. If immediate patching is not possible, consider temporarily disabling the plugin, as the vulnerable endpoint is publicly reachable and cannot be easily protected without a WAF rule targeting the specific endpoint (which may be impractical without knowing the exact route). Additionally, site administrators should audit registered shortcodes to ensure they perform proper capability checks, reducing the impact if a similar issue is exploited. See the WPScan advisory (https://wpscan.com/vulnerability/17a94434-3ccc-4282-99f5-d18043673669/) for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Meow Gallery WordPress plugin (CPE: cpe:2.3:a:unknown:meow_gallery:*:*:*:*:*:*:*:*), which fails to properly sanitize a user-supplied value before concatenating it into a shortcode string that is passed to the WordPress shortcode parser (do_shortcode) on a publicly reachable endpoint. This is classified as CWE-345 (Insufficient Verification of Data Authenticity), meaning the plugin trusts attacker-controlled input that is then interpreted as a shortcode by WordPress. Because WordPress shortcodes are macros that invoke registered handler functions, an attacker can execute any shortcode that is already registered on the site, potentially rendering non-public content such as private galleries if those shortcodes lack capability checks. The impact is limited to shortcodes that exist on the target site; there is no injection of arbitrary PHP code or direct remote code execution, and no availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) confirms network-exploitable, unauthenticated access with low confidentiality and integrity impact.
Know when Meow Gallery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated remote exploitation of a public endpoint (AV:N/AC:L/PR:N/UI:N); impact bounded to disclosure and side effects of registered shortcodes (C:L/I:L), no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Meow Gallery
View allThe Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery sh
Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holdi
Blind SQL injection in Meow Gallery up to version 5.4.4 allows high-privileged attackers to extract sensitive data from
Information disclosure in the Meow Gallery WordPress plugin before 5.5.5 lets authenticated users holding Author-level a
Meow Gallery plugin for WordPress (all versions through 5.4.4) exposes an unprotected REST API endpoint that permits any
Exploit-DB