CVE-2026-1291

🗓️ 13 Jun 2026 08:29:40Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 23 Views🌐 WEB

CVE-2026-1291 Meow Gallery <=5.4.4 allows unauthorized REST shortcode changes by Author+ users.

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2026-1291 Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation	13 Jun 202608:29	–	cvelist
EUVD	EUVD-2026-36649	13 Jun 202608:29	–	euvd
NVD	CVE-2026-1291	13 Jun 202610:16	–	nvd
Patchstack	WordPress Meow Gallery plugin <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation vulnerability	12 Jun 202619:54	–	patchstack
Positive Technologies	PT-2026-49090	13 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-1291 Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation	13 Jun 202608:29	–	vulnrichment

Vulners

Node

tigroumeow meow_galleryRange≤5.4.4wordpress

[
  {
    "vendor": "tigroumeow",
    "product": "Meow Gallery",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.4.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/3386ea07-9c61-4b54-a451-1178ca6325cb
plugins	www.plugins.trac.wordpress.org/browser/meow-gallery/trunk/classes/rest.php
plugins	www.plugins.trac.wordpress.org/changeset/3469543/meow-gallery/trunk/classes/rest.php
wordpress	www.wordpress.org/plugins/meow-gallery/
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/changeset/3469543/meow-gallery

Parameter	Position	Path	Description	CWE
id	request body	/wp-json/meow-gallery/v1/save_shortcode	REST API endpoint allows unauthorized modification of data due to missing capability check; authenticated attackers with Author level access can create/overwrite gallery shortcode records by supplying a user-controlled id value.	CWE-639

17 Jun 2026 10:15Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.14.3

EPSS0.00214

SSVC

CWE-639