WordPress Plugin Vulnerabilities

CatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST API

Description

The plugin does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.

Proof of Concept

Affects Plugins

Plugin icon
catfolders-document-gallery
Fixed in 2.0.7

References

CVE
CVE-2026-19717

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Shikhali Jamalzade
Submitter
Shikhali Jamalzade
Submitter website
https://alisalive.medium.com
Submitter twitter
0xAlisAlive
Verified
Yes
WPVDB ID
79a4bae6-96e2-44b4-a56b-42198f8b3d32

Timeline

Publicly Published
2026-08-14 (about 2 days ago)
Added
2026-08-14 (about 1 day ago)
Last Updated
2026-08-14 (about 1 day ago)

Other

Published
Title
Published
2025-08-14
Title
B Slider - Gutenberg Slider Block for WP < 2.0.1 - Authenticated (Subscriber+) Sensitive Information Exposure
Published
2025-09-27
Title
WP Popup Builder < 1.3.9 - Unauthenticated Information Exposure
Published
2024-11-20
Title
Sky Addons for Elementor < 2.6.2 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template
Published
2024-03-26
Title
WholesaleX < 1.3.2 - Sensitive Information Exposure via export_users
Published
2025-12-11
Title
Events Manager < 7.2.2.3 - Unauthenticated Information Exposure