Description

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T06:16:52.390Z",
  "pubdate": "2026-08-16T06:16:52.390Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the REST API endpoints of the CatFolders Document Gallery & PDF Library WordPress plugin prior to version 2.0.7. The vulnerability arises from missing access control checks on specific REST API endpoints.\nThis security flaw enables unauthenticated remote threat actors to query the API and retrieve sensitive metadata associated with media attachments assigned to any folder managed by the plugin. Exposed information includes document titles, file types, file sizes, and direct URLs.\nThe scope of the exposure extends to private or unpublished folders that are not actively displayed in any public-facing gallery on the WordPress site. Consequently, unauthorized entities can harvest confidential file references and potentially access restricted assets without possessing valid credentials or administrative privileges.\nThe risk implication is unauthorized information disclosure regarding media assets and internal document structures. Exploitation requires network access to the target WordPress instance's REST API and does not necessitate prior authentication or user interaction.",
  "technicalDetails": "The root cause of the vulnerability is the complete absence of authorization checks within the affected REST API endpoints implemented by the CatFolders Document Gallery & PDF Library plugin. In a secure implementation, endpoints that expose sensitive data or internal application states must validate the incoming session context, user roles, or capability tokens to ensure the requester possesses appropriate privileges.\nDue to this missing access control implementation, the application processes incoming HTTP requests to the vulnerable REST API routes without verifying whether the caller is authorized to view the requested resource collection. The vulnerable component consists of the plugin's custom REST API controller handlers responsible for querying folder structures and associated media attachment metadata.\nThe affected product is the CatFolders Document Gallery & PDF Library WordPress plugin, specifically all versions prior to 2.0.7. The vulnerability is exploitable over the network via standard HTTP/HTTPS requests directed to the exposed WordPress REST API endpoints.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the presence of the CatFolders Document Gallery & PDF Library plugin and discovers the active REST API routes registered by the plugin. Second, the attacker formulates an HTTP GET or POST request targeting the unprotected endpoints responsible for retrieving folder contents and media associations. Third, the plugin processes the request without performing any authentication or authorization validation. Finally, the application returns a JSON payload containing metadata for media attachments assigned to folders, including those that are unpublished or restricted from public view.\nThe post-exploitation impact is limited to unauthorized information disclosure, specifically the enumeration of media titles, file types, file sizes, and file URLs. While the vulnerability does not directly permit remote code execution or file modification, the harvested URLs may point to sensitive documents that lack secondary access controls, potentially leading to further data exposure."
}