Unauthorized Data Modification in Meta-box GalleryMeta Plugin for WordPress
CVE-2026-0687

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Meta-box Gallerymeta
Vendor
CVE Published:
24 January 2026

What is CVE-2026-0687?

The Meta-box GalleryMeta plugin for WordPress contains a security flaw wherein a missing capability check on the 'mb_gallery' custom post type allows authenticated users with Author-level permissions and above to create and publish galleries without proper authorization. This vulnerability could lead to unauthorized data manipulation, posing significant security risks for WordPress site owners who rely on this plugin for gallery management.

Affected Version(s)

Meta-box GalleryMeta 0 <= 3.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/meta-box-galle...
https://plugins.trac.wordpress.org/browser/meta-box-galle...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto
.