Vulnerabilities / Meow Lightbox / WPSEC-2026-1685
Meow Lightbox <= 5.6.3 - Unauthenticated Sensitive Information Exposure via 'regenerate_mwl_data' REST API Endpoint
Medium 5.3
CWE-200Fixed in 5.6.4
- ID
- WPSEC-2026-1685
- Plugin
- Meow Lightbox (meow-lightbox)
- Affected
- all versions before 5.6.4
- Remediation
- Update to 5.6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Meow Lightbox on WPSec AttackSurface
- Fix released
- Published
Description
The Meow Lightbox plugin for WordPress is vulnerable to Sensitive Information Exposure via the public 'meow-lightbox/v1/regenerate_mwl_data' REST API endpoint in all versions up to, and including, 5.6.3, due to a missing check on whether the requested attachment may be viewed by the requester. This makes it possible for unauthenticated attackers to retrieve the title, caption, description, alt text, author, file and download URLs and EXIF metadata, including GPS coordinates, of arbitrary attachments by ID, including images attached to private or draft posts.
References
- https://wpsec.com/vuln/WPSEC-2026-1685/
- https://plugins.svn.wordpress.org/meow-lightbox/tags/5.6.4/
- https://wordpress.org/plugins/meow-lightbox/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS