CVE-2026-32418
Blind SQL Injection in Meow Gallery ≤ 5.4.4 Allows Data Exposure
Publication date: 2026-03-13
Last updated on: 2026-03-13
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| meow_gallery | meow_gallery | From 5.0.0 (inc) to 5.4.4 (inc) |
| jordy_meow | meow_gallery | to 5.4.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-32418 is a SQL Injection vulnerability found in the WordPress Meow Gallery Plugin versions up to and including 5.4.4.'}, {'type': 'paragraph', 'content': "This vulnerability allows a malicious actor to perform Blind SQL Injection, which means they can interact with the plugin's database in a way that can reveal or manipulate data without direct feedback."}, {'type': 'paragraph', 'content': 'Exploitation requires author or developer-level privileges, making it less likely to be widely exploited.'}, {'type': 'paragraph', 'content': 'The issue is classified under the OWASP Top 10 category A3: Injection and has a CVSS severity score of 7.6, indicating a moderate risk.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can allow an attacker with author or developer-level access to interact directly with the plugin's database."}, {'type': 'paragraph', 'content': 'Potential impacts include theft or manipulation of data stored by the Meow Gallery plugin.'}, {'type': 'paragraph', 'content': 'Although the CVSS score is moderately high (7.6), the vulnerability is considered low priority with low severity impact and is unlikely to be widely exploited.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate the SQL Injection vulnerability in the Meow Gallery Plugin, you should update the plugin to version 5.4.5 or later, where the issue is resolved.'}, {'type': 'paragraph', 'content': "Additionally, using mitigation services such as Patchstack's auto-updates for vulnerable plugins can help reduce risk."}] [1]