---
id: CVE-2026-13747
title: >-
  Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+)
  Information Disclosure via fetch_posts REST Endpoint
summary: >-
  The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in
  all versions up to, and including, 5.5.4 This is due to the plugin not
  properly verifying that a user is authorized to perform an action. This makes
  it possib…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: tigroumeow
product: Meow Gallery
affected:
  - meow_gallery <= 5.5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:26:13.058750Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:26:22.628Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-13747'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/1f35d2c6-b631-40ba-b92a-972a891d4623?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.5.1/classes/rest.php#L622
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.5.1/classes/rest.php#L123
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.5.1/classes/core.php#L77
  - url: >-
      https://plugins.trac.wordpress.org/changeset?old_path=/meow-gallery/tags/5.5.4&new_path=/meow-gallery/tags/5.5.5
tags:
  - cve.org
epss: 0.0039
epssPercentile: 0.33302
ingestedAt: '2026-11-05T16:24:31.280Z'
---

## Overview

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.

## Affected

- `meow_gallery <= 5.5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.