CVE-2026-1291
Published
CVSS v3
4.3
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the REST API endpoint /wp-json/meow-gallery/v1/save_shortcode in all versions up to, and including, 5.4.4 This makes it possible for authenticated attackers, with Author-level access and above, to arbitrarily create or overwrite existing gallery shortcode records by supplying a user-controlled id value. The endpoint performs database update operations without verifying that the requesting user is authorized to modify the referenced gallery record or create their own.
<p><strong>Meow Gallery is the lightweight, polished gallery solution for WordPress.</strong> Built from scratch for simplicity, appearance, and speed. Features a Gallery Block, shortcode support, or works as an override for the standard WordPress gallery. It’s responsive, retina-friendly, with modern layouts, and tightly optimized.</p>
<p>Stop fighting bloated gallery plugins that turn your WordPress into a slower experience! 😘</p>
<p>Meow Gallery focuses on what actually matters: <strong>Beautiful Layouts</strong> and <strong>Performance</strong>. Check out <a href="https://meowapps.com/meow-gallery/" rel="nofollow ugc">our official site</a> and see <a href="https://meowapps.com/meow-gallery/layouts/" rel="nofollow ugc">the layouts in action</a> to get started.</p>
<h3>Core Features</h3>
<p>🎨 <strong>Beautiful Layouts</strong><br />
Choose from Tiles, Masonry, Justified (like Flickr), Square (like Instagram), Cascade, and Horizontal. Pro version adds Carousel and Map layouts.</p>
<p>🚀 <strong>Performance First</strong><br />
Built from scratch with modern code. No legacy bloat, no unnecessary features. Just clean, fast galleries.</p>
<p>🔌 <strong>WordPress Native</strong><br />
Works naturally with WordPress and Gutenberg without hacking it. Use the Gallery Block, shortcode, or override the standard WordPress gallery. Switch back anytime—no lock-in.</p>
<p>📱 <strong>Responsive & Retina</strong><br />
All layouts are fully responsive and retina-ready for crisp images on any device.</p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/ZyboZqZb9JQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h3>Compatibility</h3>
<p>Since Meow Gallery works with WordPress naturally, it’s compatible with most plugins and themes:</p>
<ul>
<li><strong>Lightbox</strong>: Use any lightbox you prefer. We recommend <a href="https://wordpress.org/plugins/meow-lightbox/" rel="ugc">Meow Lightbox</a> for the best experience.</li>
<li><strong>Lightroom</strong>: Fully compatible with <a href="https://wordpress.org/plugins/wplr-sync/" rel="ugc">Photo Engine</a> for media organization and Lightroom sync.</li>
<li><strong>External Links</strong>: Use <a href="https://wordpress.org/plugins/gallery-custom-links/" rel="ugc">Gallery Custom Links</a> to add custom URLs to your images.</li>
<li><strong>Audio</strong>: Add audio to images with <a href="https://wordpress.org/plugins/audio-story-images/" rel="ugc">Audio Story Images</a>.</li>
</ul>
<p>SEO-friendly with automatic sitemap integration (works with Yoast SEO and others).</p>
<h3>Pro Features</h3>
<ul>
<li><strong>Infinite/Lazy Loading</strong>: Faster page loading and smoother experience</li>
<li><strong>Carousel Layout</strong>: Dynamic slider/carousel that can also work as a hero</li>
<li><strong>Map Layout</strong>: GPS-based photo display for travel galleries</li>
<li><strong>Animations</strong>: Bring your galleries to life with smooth animations</li>
</ul>
<p>You can find more information on <a href="https://meowapps.com/meow-gallery/" rel="nofollow ugc">Meow Apps: Meow Gallery</a>.</p>