CVE-2026-19717: CatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST API
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19717?
CVE-2026-19717 has a risk score of 36, indicating a significant vulnerability.
How do I fix CVE-2026-19717?
To fix CVE-2026-19717, update the CatFolders Document Gallery & PDF Library plugin to version 2.0.7 or later.
What type of vulnerability is CVE-2026-19717?
CVE-2026-19717 is classified as an information leakage vulnerability due to its unauthenticated attachment disclosure.
What data can be accessed due to CVE-2026-19717?
CVE-2026-19717 allows unauthorized users to retrieve media attachment titles, types, sizes, and URLs.
Which plugin is affected by CVE-2026-19717?
CVE-2026-19717 affects the CatFolders Document Gallery & PDF Library plugin versions prior to 2.0.7.