The Meow Gallery WordPress plugin, prior to version 5.5.5, fails to sanitize a value supplied through its load_gallery_collection REST route. By concatenating this value into a shortcode string, the plugin leaks the Shortcode parser to unauthenticated users, enabling them to execute any registered shortcode. This flaw results in the disclosure of non‑public gallery content and can be leveraged to run arbitrary code through shortcodes that perform privileged actions. The weakness aligns with improper input validation leading to unintended code execution.

Systems running the Meow Gallery WordPress plugin versions older than 5.5.5 on any WordPress installation are susceptible. The vulnerability exists in the public REST endpoint load_gallery_collection, which is accessible without authentication.

The EPSS score is not available and the vulnerability is not listed in KEV. Although no CVSS score is supplied, the ability to run arbitrary shortcodes without authentication suggests a high severity impact. Attackers could reach the endpoint over the public network, send a crafted request, and trigger the plugin’s shortcode parsing logic. Because the vulnerability requires no prior authentication, the likelihood of exploitation is high in environments lacking additional access controls. The lack of known mitigation in official advisories highlights the need for immediate attention.