Security Alert Summary
The Meow Gallery WordPress plugin before 5.5.5 contains an input sanitization issue that allows an unauthenticated user to supply a value which is concatenated into a shortcode string passed to the WordPress shortcode parser on a publicly reachable endpoint. This can enable execution of arbitrary registered shortcodes and may disclose non-public gallery content.
CVE Details
- CVE ID:
CVE-2026-92422 - Affected component: Meow Gallery WordPress plugin
- Affected versions: Versions before 5.5.5 (versions < 5.5.5)
- Published: September 20, 2026 at 07:16:51 AM
- Last modified: September 20, 2026 at 02:16:59 PM
- CVSS v3.1 base score: 6.5 (MEDIUM)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-345 (Insufficient Verification of Data Authenticity)
Technical Details
The plugin fails to properly sanitize a user-supplied value before concatenating it into a shortcode string that is handed to the WordPress shortcode parser on a publicly reachable endpoint. Because the value is not validated or escaped, an attacker who can reach that endpoint may cause the parser to execute arbitrary registered shortcodes.
The described issue relies on concatenation of untrusted input into a shortcode string and the subsequent invocation of the WordPress shortcode parser. The vulnerability allows an unauthenticated actor to trigger execution of any shortcode registered on the site and to cause disclosure of gallery content that is not intended to be public.
Impact is limited to the capabilities of executed shortcodes and the data those shortcodes expose; the entry point is a public endpoint that constructs and parses shortcodes using unsanitized input.
How This Could Impact Your Website
Consider a small team running a WordPress site with Meow Gallery: the site owner manages plugins and permissions, an internal editor uploads and organizes protected galleries, and an external contractor occasionally contributes content. If the site is running an affected version of Meow Gallery, an unauthenticated visitor who discovers the publicly reachable endpoint could craft requests that execute registered shortcodes. That could lead to disclosure of non-public gallery items or metadata, and to changes in content rendered by shortcodes where those shortcodes perform write actions.
Practical consequences include exposure of non-public gallery media or associated metadata, which can reveal internal file names or user-submitted content, and increased risk of targeted phishing or social engineering if contact information is exposed. These effects align with the CVSS impacts of limited confidentiality and integrity loss rather than full site compromise.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can upload or manage media.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and access logs for unusual requests to public endpoints or unexpected shortcode execution.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
