Executive brief
Meow Gallery, a WordPress plugin for managing image galleries, contains a vulnerability in a publicly accessible endpoint that fails to properly sanitize user input. An unauthenticated attacker can exploit this to execute arbitrary shortcodes and access private gallery content without authentication.
Technical details
The plugin fails to sanitize a user-supplied value before concatenating it into a shortcode string passed to WordPress's shortcode parser via the load_gallery_collection REST route. This content injection vulnerability (CWE-345) allows unauthenticated attackers to execute arbitrary registered shortcodes and disclose non-public gallery content through a network-accessible endpoint.
Affected products
- Meow Gallery before 5.5.5
Timeline
- 2026-09-18: disclosed
- 2026-09-20: patched: Fixed in version 5.5.5