Description

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-20T07:16:51.160Z",
  "pubdate": "2026-09-20T07:16:51.160Z",
  "executiveSummary": "Meow Gallery versions prior to 5.5.5 are affected by an information disclosure vulnerability stemming from insufficient access control checks. The flaw resides in the handling of post-query requests, which fail to validate user capabilities or restrict the scope of retrieved posts to the requesting user’s own content.\nThe vulnerability allows authenticated users with Author-level privileges or higher to access sensitive metadata—including titles, author names, creation dates, and post statuses—for draft and private posts belonging to other users. This exposes internal editorial workflows and potentially sensitive content that is not intended for public or lower-privileged exposure.\nThe risk is categorized as unauthorized information disclosure. While the vulnerability is restricted to authenticated users, it bypasses intended WordPress permission models. The exploit does not require specialized technical tools, merely the ability to interact with the plugin’s data-fetching endpoints. Organizations relying on granular post visibility and editorial privacy are at increased risk of internal information leakage.",
  "technicalDetails": "The vulnerability originates from a failure in the plugin’s server-side logic to perform robust capability checks (using current_user_can()) or implement restrictive filters on database queries when handling requests for post data. In WordPress, retrieving posts—especially those in 'draft' or 'private' status—requires explicit verification that the requesting user possesses the necessary privileges to view such content, or that the query is scoped solely to the current user's ID.\nThe root cause is an insecure API or data-retrieval function that processes HTTP requests and returns a list of posts without validating the user's role against the retrieved data objects. Because the plugin does not enforce these checks, it effectively ignores the WordPress post-visibility layer.\nExploitation follows a predictable flow: An authenticated user with Author-level access triggers the vulnerable function, typically via a specific AJAX action or REST API endpoint provided by the plugin. The server-side code executes a database query to fetch post information. Because the query is not scoped using 'author' parameters or filtered via 'posts_clauses' to enforce ownership, the database returns objects including those not authored by the requestor.\nOnce the data is retrieved, the plugin serializes this information and returns it to the client side. An attacker can intercept this response to enumerate internal post titles, associated metadata, and the status of ongoing drafts. This allows for unauthorized reconnaissance of sensitive project names, future content strategies, or confidential draft material.\nThe attack is limited to authenticated users; however, the Author role is typically common in collaborative WordPress environments. Because the vulnerability is present in versions before 5.5.5, any instance of Meow Gallery within this version range is susceptible to this internal reconnaissance. There is no indication of remote code execution or privilege escalation; the impact is strictly confined to the unauthorized disclosure of information that should be private to the site administrator or the individual author."
}