Description

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-20T07:16:51.060Z",
  "pubdate": "2026-09-20T07:16:51.060Z",
  "executiveSummary": "The Meow Gallery WordPress plugin, in versions prior to 5.5.5, is susceptible to an unauthenticated shortcode injection vulnerability.\nThe flaw originates from improper input sanitization of user-supplied data that is subsequently integrated into shortcode strings processed by the WordPress shortcode parser.\nThis vulnerability is accessible via publicly reachable endpoints, requiring no authentication or elevated privileges for exploitation.\nBy injecting crafted shortcode parameters, an attacker can manipulate the internal execution of registered shortcodes.\nThe primary security impact involves the unauthorized disclosure of non-public gallery content, potentially exposing sensitive media or configuration data that should remain restricted.\nThis vulnerability poses a significant risk to site confidentiality, as it allows external actors to bypass access controls related to gallery visibility and rendering.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient sanitization mechanism for input parameters handled by the Meow Gallery plugin before they are passed to the WordPress shortcode API.\nWordPress shortcodes allow for the execution of predefined functional hooks within content areas; by failing to sanitize user input before concatenating it into a shortcode string, the plugin permits the injection of malicious shortcode attributes or the execution of arbitrary registered shortcodes.\nThe attack flow commences with an unauthenticated user identifying an endpoint within the Meow Gallery plugin that accepts user input, such as query parameters or POST data, which is then dynamically incorporated into a shortcode block.\nBecause the input is not appropriately sanitized or validated against an allowlist, an attacker can craft a malicious payload containing parameters that the WordPress `do_shortcode()` or equivalent parsing function will interpret as valid shortcode arguments.\nThis manipulation allows the attacker to force the plugin to load or reveal galleries that were intended to be private, password-protected, or otherwise restricted from public view.\nSince the execution occurs server-side via the legitimate shortcode parser, the plugin treats the injected parameters as trusted input, thereby triggering the underlying gallery retrieval logic with unintended arguments.\nAffected versions include all iterations of Meow Gallery prior to 5.5.5. The vulnerability resides within the module responsible for generating and parsing gallery shortcodes from user-provided input.\nExploitation does not require prior authentication or session tokens, making it a highly accessible vector for remote attackers who can interact with the WordPress site's public-facing endpoints.\nPost-exploitation impact is primarily focused on information disclosure. By iteratively querying the shortcode parser with modified parameters, an attacker can enumerate hidden galleries, bypass display restrictions, and exfiltrate private media metadata and file locations.\nThe vulnerability effectively subverts the site's authorization layer, allowing unauthorized access to protected gallery resources through the abuse of existing WordPress infrastructure."
}