CVE-2026-0687

Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management

Published Jan 24, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mb_gallery' custom post type in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Author-level access and above, to create and publish galleries.

Analysis

Technical impact

The Meta‑box GalleryMeta WordPress plugin has a missing capability check on the custom post type ‘mb_gallery’ in all releases up to and including 3.0.1. This flaw allows authenticated users with Author privileges or higher to create and publish gallery posts without appropriate authorization. The weakness is classified as CWE‑862, an authorization failure due to a missing privilege check.

Affected Systems

Any WordPress site that has the Meta‑box GalleryMeta plugin installed and active at version 3.0.1 or earlier is vulnerable; the issue is independent of other plugins or themes.

Risk and Exploitability

The CVSS score of 4.3 reflects low‑to‑moderate severity, and the EPSS score of less than 1% indicates very rare exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated and possess at least Author role. No public exploit has been documented, and exploitation requires only the submission of gallery creation requests that bypass the missing capability check.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

shahinurislam

Meta-box GalleryMeta

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.0.1

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Meta‑box GalleryMeta plugin to the latest available version, which should include the fix for the missing capability check.
Restrict Author-level permissions or create custom roles that exclude the ability to add or edit gallery posts.
Audit existing gallery posts for unauthorized or malicious content and enable monitoring of gallery creation activity.

Generated by OpenCVE AI on April 18, 2026 at 18:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.225% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/meta-box-gallerymeta/tags/3.0.1/gallerymetaboxes.php#L375
https://plugins.trac.wordpress.org/browser/meta-box-gallerymeta/tags/3.0.1/include/posttype.php#L29
https://www.wordfence.com/threat-intel/vulnerabilities/id/872c61aa-c95c-4b86-8e39-8112bb117a0b?source=cve

History

Jan 26, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 26, 2026 12:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Jan 24, 2026 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mb_gallery' custom post type in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Author-level access and above, to create and publish galleries.
Title		Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/meta-box-gallerymeta/tags/3.0.1/gallerymetaboxes.php#L375 https://plugins.trac.wordpress.org/browser/meta-box-gallerymeta/tags/3.0.1/include/posttype.php#L29 https://www.wordfence.com/threat-intel/vulnerabilities/id/872c61aa-c95c-4b86-8e39-8112bb117a0b?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`