CVE-2026-19430: CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all

Q: Who is exposed to this issue?

Sites using CatFolders Document Gallery Pro versions earlier than 2.0.7 are exposed if they store documents in folders that have not been published. Unauthenticated remote users can list and download those folder contents.

Q: What does an attacker need to exploit it?

The attacker does not need to authenticate. They can forge the client-side token used to identify requested content and use REST API routes that do not enforce authorization.

Q: How can I determine whether content may already be exposed?

Review whether the plugin is installed at a version earlier than 2.0.7 and whether it contains unpublished folders with sensitive documents. Those folders may have been enumerable and downloadable by unauthenticated users.

Published Aug 29, 2026

Updated

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.

Affected Software

1 affected component

CatFolders Document Gallery Pro (WordPress plugin)<2.0.7

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using CatFolders Document Gallery Pro versions earlier than 2.0.7 are exposed if they store documents in folders that have not been published. Unauthenticated remote users can list and download those folder contents.

What does an attacker need to exploit it?

The attacker does not need to authenticate. They can forge the client-side token used to identify requested content and use REST API routes that do not enforce authorization.

How can I determine whether content may already be exposed?

Review whether the plugin is installed at a version earlier than 2.0.7 and whether it contains unpublished folders with sensitive documents. Those folders may have been enumerable and downloadable by unauthenticated users.

CVE-2026-19430: CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether content may already be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether content may already be exposed?