CVE-2026-92423 Overview
CVE-2026-92423 is an information disclosure vulnerability in the Meow Gallery WordPress plugin versions prior to 5.5.5. The plugin fails to perform a proper capability check and does not restrict returned post data to the requesting user's own content. Authenticated users with Author-level access or higher can retrieve titles, authors, dates, and statuses of other users' draft and private posts. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Authenticated Author-level attackers can enumerate metadata about draft and private posts belonging to other users on the same WordPress site.
Affected Products
- Meow Gallery WordPress plugin versions before 5.5.5
- WordPress sites permitting Author-level or higher registrations
- Multi-author WordPress installations using Meow Gallery
Discovery Timeline
- 2026-09-20 - CVE-2026-92423 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-92423
Vulnerability Analysis
The Meow Gallery plugin exposes an endpoint that returns post data to authenticated users. The endpoint does not verify whether the caller has the WordPress capability required to view drafts or private posts owned by others. It also does not filter query results by post author, so all matching posts are returned regardless of ownership.
An authenticated attacker holding the Author role can invoke this functionality to receive metadata for posts they should not see. The disclosed fields include post titles, author identifiers, creation and modification dates, and publication status. While post bodies are not exposed, the leaked metadata can reveal upcoming announcements, internal drafts, and editorial workflow details.
Root Cause
The root cause is a missing authorization check combined with an unfiltered query. WordPress provides current_user_can() for capability enforcement and expects plugins to scope queries with an author parameter when non-privileged users request post lists. The vulnerable plugin code omits both controls before returning post objects.
Attack Vector
Exploitation requires network access to the WordPress site and valid Author-level credentials. The attacker sends an authenticated request to the vulnerable plugin endpoint and parses the JSON response for private and draft posts. No user interaction is required, and the attack does not modify data. Refer to the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-92423
Indicators of Compromise
- Requests from Author-level accounts to Meow Gallery AJAX or REST endpoints returning post lists.
- Unexpected access to admin-ajax.php actions associated with the Meow Gallery plugin from lower-privileged users.
- Elevated response payload sizes for authenticated plugin endpoints, suggesting bulk post enumeration.
Detection Strategies
- Review WordPress access logs for authenticated calls to Meow Gallery endpoints originating from non-Editor accounts.
- Correlate plugin API responses against post ownership to identify cross-author data retrieval.
- Deploy web application firewall rules that inspect Meow Gallery request parameters for enumeration patterns.
Monitoring Recommendations
- Enable WordPress audit logging to track REST and AJAX activity per user role.
- Monitor new Author-level account creation, particularly on sites accepting open registration.
- Alert on repeated requests to plugin endpoints returning post data within short time windows.
How to Mitigate CVE-2026-92423
Immediate Actions Required
- Upgrade the Meow Gallery plugin to version 5.5.5 or later on all WordPress sites.
- Audit existing Author-level and higher user accounts for legitimacy, and disable inactive accounts.
- Rotate credentials for any accounts suspected of unauthorized access.
Patch Information
The vendor addressed CVE-2026-92423 in Meow Gallery version 5.5.5. The fix adds a capability check and scopes returned posts to those owned by the requesting user. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. See the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Temporarily deactivate the Meow Gallery plugin until the patched version is installed.
- Restrict user registration and demote unnecessary Author-level accounts to Contributor or Subscriber.
- Place the vulnerable plugin endpoints behind a web application firewall rule that blocks requests from non-Editor roles.
# Update Meow Gallery via WP-CLI
wp plugin update meow-gallery --version=5.5.5
wp plugin list --name=meow-gallery --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.