CVE-2026-1291: Meow Gallery WordPress Auth Bypass Issue

CVE-2026-1291 Overview

The Meow Gallery plugin for WordPress contains a missing capability check on the /wp-json/meow-gallery/v1/save_shortcode REST API endpoint. The flaw affects all plugin versions up to and including 5.4.4. Authenticated attackers with Author-level access or higher can arbitrarily create or overwrite gallery shortcode records by supplying a user-controlled id value. The endpoint executes database update operations without verifying that the requesting user is authorized to modify the referenced gallery record. This vulnerability is categorized as an Authorization Bypass [CWE-639], specifically an Insecure Direct Object Reference (IDOR). The issue was resolved in version 5.4.5.

Critical Impact
Authenticated users with Author privileges or above can tamper with any gallery shortcode record stored by the plugin, enabling unauthorized data modification across the WordPress site.

Affected Products

Meow Gallery plugin for WordPress, versions through 5.4.4
WordPress installations exposing the /wp-json/meow-gallery/v1/save_shortcode REST endpoint
Sites permitting Author-level or higher user registration with the plugin enabled

Discovery Timeline

2026-06-13 - CVE-2026-1291 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-1291

Vulnerability Analysis

The vulnerability resides in the REST API handler implemented in classes/rest.php of the Meow Gallery plugin. The save_shortcode route accepts an id parameter from the request body and uses it directly in a database update operation. The handler verifies that the requester is authenticated but does not confirm that the user owns the referenced gallery record or has the privilege to write to it.

Because the capability check is absent, any user with Author-level access or higher can craft a request specifying an arbitrary id value. The plugin will create a new shortcode record or overwrite an existing one without enforcing object-level ownership. This is a textbook Authorization through User-Controlled Key issue [CWE-639].

Root Cause

The root cause is a missing capability check inside the REST endpoint callback. The route registration relies on authentication alone as the access criterion. The handler trusts the supplied id and writes to the underlying gallery table without correlating the record owner to the current user.

Attack Vector

Exploitation requires a valid WordPress account with Author privileges or higher and network access to the site's REST API. The attacker issues an authenticated POST request to /wp-json/meow-gallery/v1/save_shortcode with a chosen id and shortcode payload. The plugin commits the write, overwriting another user's gallery configuration or injecting attacker-controlled shortcode content. Refer to the WordPress Meow Gallery Code and the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-1291

Indicators of Compromise

Unexpected POST requests to /wp-json/meow-gallery/v1/save_shortcode from low-privilege accounts such as Authors or Contributors elevated to Author.
Gallery shortcode records modified by user accounts that did not originally create them.
New gallery shortcode entries with id values that do not match the expected auto-increment sequence.

Detection Strategies

Inspect web server and WordPress access logs for requests to the meow-gallery/v1/save_shortcode endpoint and correlate with the authenticated user ID.
Audit the gallery shortcode database table for ownership mismatches between record creators and last-modified user IDs.
Run an outdated-plugin scan to identify WordPress sites still running Meow Gallery version 5.4.4 or earlier.

Monitoring Recommendations

Enable verbose REST API request logging on WordPress sites with public registration or many Author-level accounts.
Alert on REST writes to plugin endpoints performed by accounts below Editor privilege.
Track WordPress plugin version inventory continuously and flag installs that lag behind upstream releases.

How to Mitigate CVE-2026-1291

Immediate Actions Required

Update the Meow Gallery plugin to version 5.4.5 or later on all WordPress installations.
Review the gallery shortcode table for unauthorized modifications and restore any tampered records from backups.
Audit Author-level and higher accounts and revoke access for users that no longer require it.

Patch Information

The maintainer addressed the issue in version 5.4.5 by adding a capability check to the REST callback. The relevant commit is documented in the WordPress Meow Gallery Changeset and the version update diff. Install the update via the WordPress plugin manager or download from the Meow Gallery Plugin Page.

Workarounds

Restrict access to the /wp-json/meow-gallery/v1/save_shortcode endpoint at the web application firewall (WAF) until the plugin is updated.
Temporarily deactivate the Meow Gallery plugin on sites that cannot patch immediately.
Reduce the privileges of non-essential Author-level accounts to Contributor or Subscriber to remove access to the vulnerable endpoint.

bash

# Example WAF rule: block save_shortcode writes from non-Editor sessions
# Adjust to match your WAF syntax
SecRule REQUEST_URI "@contains /wp-json/meow-gallery/v1/save_shortcode" \
  "id:1029261,phase:2,deny,status:403,log,\
  msg:'Block Meow Gallery save_shortcode pending patch (CVE-2026-1291)'"