The Meow Gallery plugin for WordPress is vulnerable to an authorization bypass that allows authenticated users with author-level or higher privileges to enumerate and read metadata of all private and draft posts, including those authored by other users. This flaw arises because the plugin fails to properly verify a user’s authorization before exposing post information through the fetch_posts REST endpoint. As a result, an attacker can obtain post IDs, titles, dates, authors, and status without needing to log in as the original author, potentially leading to disclosure of sensitive content and insights into site structure.

All releases of Meow Gallery up to and including version 5.5.4 distributed by tigroumeow are affected. The vulnerability pertains specifically to the fetch_posts REST endpoint implementation in these versions. Operators using any of these releases should verify their site’s Meow Gallery version and apply updates.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector requires an authenticated session with author or higher privileges; therefore, only users who already have some level of access to the site can exploit it. Because the flaw does not require elevated privileges or remote exploitation, the threat is limited to users who can log in, but the ability to enumerate all private draft content makes this a significant privacy concern for site owners.