The Meow Gallery WordPress plugin, prior to version 5.5.5, fails to sanitize a value supplied through its load_gallery_collection REST route. By concatenating this value into a shortcode string, the plugin leaks the Shortcode parser to unauthenticated users, enabling them to execute any registered shortcode. This flaw results in the disclosure of non‑public gallery content and can be leveraged to run arbitrary code through shortcodes that perform privileged actions. The weakness aligns with improper input validation leading to unintended code execution.

Systems running the Meow Gallery WordPress plugin versions older than 5.5.5 on any WordPress installation are susceptible. The vulnerability exists in the public REST endpoint load_gallery_collection, which is accessible without authentication.

The EPSS score of <1% indicates a very low probability of exploitation, and the CVSS score of 6.5 classifies this vulnerability as medium severity. Even so, the ability to execute any registered shortcode without authentication enables attackers to disclose non‑public content and potentially trigger privileged actions. The vulnerability is not listed in the CISA KEV catalog, but the lack of authentication required for the public REST endpoint means that any attacker can reach and exploit it. Even with low anticipated exploitation likelihood, the impact of unauthorized code execution warrants prompt patching.