The Meow Gallery WordPress plugin before 5.5.5 allows an authenticated user with Author privileges or higher to retrieve the titles, authors, dates, and statuses of other users' draft and private posts. This occurs because the plugin fails to verify that the requesting user has permission to view the requested posts and does not limit the results to the user’s own posts. The result is an unauthorized disclosure of post metadata that could aid further reconnaissance or social engineering attacks.

WordPress sites using the Meow Gallery plugin version 5.5.4 or earlier. Any installation that has not applied the 5.5.5 update is affected.

An attacker must be authenticated with at least Author level privileges to exploit the flaw, making the attack vector authenticated. Once the user calls the fetch_posts endpoint, the plugin returns the restricted metadata. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of exploitation in the wild. The severity cannot be inferred from a CVSS score, but the lack of a publicly known CVE mitigates the immediacy of risk. Nonetheless, the exposure of private post information is a significant concern for confidentiality.