CVE-2026-0687 describes a missing authorization vulnerability in the Meta-box GalleryMeta plugin for WordPress. The plugin fails to enforce capability checks on the 'mb_gallery' custom post type, allowing authenticated users with Author-level privileges or above to create and publish galleries without proper permissions. This could lead to unauthorized modification of data within the plugin's scope. The vulnerability affects all versions up to and including 3.0.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the level of an authenticated author, no user interaction needed, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows authenticated users with Author-level access or higher to create and publish galleries without proper authorization checks. This could result in unauthorized content modification within the WordPress site using the vulnerable plugin. There is no impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only. Monitor for updates from the plugin vendor or WordPress security advisories regarding patches or temporary mitigations.