Description

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-29T06:17:24.857Z",
  "pubdate": "2026-08-29T06:17:24.857Z",
  "executiveSummary": "The Catfolders Document Gallery Pro WordPress plugin, specifically versions prior to 2.0.7, contains a critical security vulnerability involving improper authorization within its REST API implementation.\nThis vulnerability allows unauthenticated remote attackers to bypass access controls and perform unauthorized operations, specifically the enumeration and extraction of files from folders that were intended to remain private or unpublished.\nThe flaw stems from insufficient server-side validation of authorization tokens, which are susceptible to client-side forgery.\nThe risk implication is significant, as it leads to the exposure of sensitive documents or proprietary files hosted within the plugin's environment.\nExploitation requires no prior authentication or administrative privileges, making it highly accessible to attackers. Mitigation requires immediate update to the patched version, as the vulnerability directly affects the integrity and confidentiality of stored digital assets.",
  "technicalDetails": "The vulnerability is rooted in an insecure implementation of the REST API endpoints provided by the Catfolders Document Gallery Pro plugin. Specifically, the plugin fails to enforce proper authorization checks on critical API routes intended to facilitate file and folder management.\nThe root cause of this flaw is twofold: first, the lack of server-side capability or permission checks before processing API requests; second, the use of a predictable or forgeable token mechanism to identify and access requested content.\nIn a secure implementation, the REST API must verify that the requester possesses the required permissions (e.g., 'edit_posts' or specific plugin-defined capabilities) before exposing file metadata or allowing file downloads. In this vulnerable version, the server assumes the client-provided token is legitimate without verifying its authenticity or ownership against the requested resource.\nAttackers can exploit this by identifying the REST API endpoints responsible for retrieving folder contents. Since the token is forgeable client-side, an attacker can construct a crafted HTTP request containing a forged token that corresponds to a target folder's unique identifier. The plugin's back-end logic processes the request, interprets the forged token as valid, and returns a list of files or provides a direct download path to the requested content.\nThe attack flow is as follows: 1) The attacker observes the structure of REST API calls performed by the plugin. 2) The attacker generates a forged token that matches the expected format for a sensitive folder. 3) The attacker submits a GET request to the vulnerable API endpoint with the forged token. 4) The server bypasses authorization checks and returns the directory listing or the file payload. 5) The attacker retrieves private, non-published data directly from the server. This vulnerability allows for automated mass-enumeration of files if the folder structure is predictable or discoverable, leading to full directory traversal and unauthorized data exfiltration."
}