CVE-2026-19430
Received Received - Intake

Unauthenticated Folder Content Access in Catfolders Document Gallery Pro

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: WPScan

Description
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-19430
EUVD
EUVD-2026-68049

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
catfolders document_gallery_pro to 2.0.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Catfolders Document Gallery Pro WordPress plugin before version 2.0.7 has an authorization flaw in its REST API routes. Unauthenticated users can forge a client-side token to list and download contents from folders that were never published on the site.

Detection Guidance

Check if the CatFolders Document Gallery Pro plugin version is below 2.0.7. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the installed version.

Impact Analysis

This vulnerability allows unauthorized users to access and download private folder contents from your WordPress site without authentication. Sensitive documents could be exposed, leading to data leaks or privacy breaches.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other privacy regulations by exposing sensitive data to unauthorized parties. Organizations may face legal penalties or reputational damage if such breaches occur.

Mitigation Strategies

Update the CatFolders Document Gallery Pro plugin to version 2.0.7 or later immediately to patch the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart