CVE-2026-1291: Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation
The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the REST API endpoint /wp-json/meow-gallery/v1/saveshortcode in all versions up to, and including, 5.4.4 This makes it possible for authenticated attackers, with Author-level access and above, to arbitrarily create or overwrite existing gallery shortcode records by supplying a user-controlled id value. The endpoint performs database update operations without verifying that the requesting user is authorized to modify the referenced gallery record or create their own.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/meow-galleryfrom your environment.Uninstall the Meow Gallery plugin if it is not required for site functionality.
- Configuration
Block or disable the /wp-json/meow-gallery/v1/save_shortcode REST endpoint to prevent authenticated Author+ users from creating or overwriting gallery shortcode records (for example via a code snippet that unregisters the route, a plugin that blocks REST routes, or server rules).
Meow Gallery (REST API endpoint) /wp-json/meow-gallery/v1/save_shortcode = disabled - Compensating control
Apply WAF/reverse-proxy or webserver rules to restrict access to /wp-json/meow-gallery/v1/save_shortcode to trusted administrator IPs or authenticated administrator users only, until an upstream fix is available.
- Operational
Audit Meow Gallery shortcode records for unauthorized creations or overwrites, restore affected records from backups if necessary, and review access logs to identify Author+ accounts that performed changes; remove or remediate any compromised or untrusted accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1291?
CVE-2026-1291 has a medium severity rating of 4.3.
How do I fix CVE-2026-1291?
To fix CVE-2026-1291, update the Meow Gallery plugin to version 5.4.5 or later.
What type of vulnerability is CVE-2026-1291?
CVE-2026-1291 is a vulnerability that involves missing authorization checks in a REST API endpoint.
Who is affected by CVE-2026-1291?
Authenticated users with Author-level permissions in Meow Gallery versions up to 5.4.4 are affected by CVE-2026-1291.
What can attackers do with CVE-2026-1291?
Attackers exploiting CVE-2026-1291 can modify data by creating shortcodes without proper authorization.