CVE-2026-19430
CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all
CVSS Score
5.3
EPSS Score
0.1%
EPSS Percentile
3th
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.
| Vendor | unknown |
| Product | catfolders document gallery pro |
| Published | Aug 29, 2026 |
| Last Updated | Aug 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown catfolders document gallery pro
Be the first to know when new medium vulnerabilities affecting unknown catfolders document gallery pro are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Catfolders Document Gallery Pro
2.0.6 < 2.0.7
References
Credits
Shikhali Jamalzade WPScan