CVE-2026-19430 Overview
CVE-2026-19430 is a missing authorization vulnerability in the Catfolders Document Gallery Pro WordPress plugin before version 2.0.7. The plugin fails to authorize several of its REST API routes. The token used to identify the requested content is forgeable client-side. Unauthenticated attackers can list and download the contents of folders that were never published on the site. The flaw is classified under [CWE-862] Missing Authorization.
Critical Impact
Unauthenticated remote attackers can enumerate and exfiltrate unpublished documents hosted through the plugin, exposing confidential files intended to remain private.
Affected Products
- Catfolders Document Gallery Pro WordPress plugin versions before 2.0.7
- WordPress sites exposing the plugin's REST API endpoints
- Any site using Catfolders Document Gallery Pro to host non-public folders
Discovery Timeline
- 2026-08-29 - CVE-2026-19430 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-19430
Vulnerability Analysis
The Catfolders Document Gallery Pro plugin exposes REST API routes to serve folder listings and document downloads. Several of these routes do not enforce authorization checks. The plugin identifies the requested content using a token that the client generates and submits with the request. Because the token is forgeable client-side, an attacker can construct arbitrary values and request folders that were never published on the site. The server returns folder listings and document contents without verifying the caller's permission to access them. The result is broken access control that exposes private files to any anonymous requester on the internet.
Root Cause
The root cause is missing authorization on REST API routes combined with client-controlled content identifiers. The plugin trusts a token supplied by the client rather than validating server-side ownership, publication state, or user capability. Authorization decisions must not depend on values the caller can forge.
Attack Vector
Exploitation requires network access to the WordPress site and no authentication or user interaction. An attacker sends crafted HTTP requests to the plugin's REST API routes with forged token values. The server responds with directory listings and downloadable file content from folders that administrators intended to keep unpublished. See the WPScan Vulnerability Report for details.
Detection Methods for CVE-2026-19430
Indicators of Compromise
- Unauthenticated HTTP GET requests to Catfolders REST API routes under /wp-json/ containing folder or document identifiers.
- Spikes in outbound file downloads originating from the plugin's REST endpoints without a corresponding logged-in session.
- Requests from unfamiliar user agents or IP addresses enumerating sequential or randomized folder tokens.
Detection Strategies
- Review WordPress access logs for anonymous requests to plugin REST routes returning HTTP 200 with non-trivial response sizes.
- Correlate REST API traffic with publication state; downloads of folders not linked from any public page indicate misuse.
- Deploy web application firewall rules that flag high-frequency access to Catfolders endpoints from a single source.
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and forward events to a centralized logging platform.
- Alert on REST responses that deliver document MIME types to unauthenticated clients.
- Baseline normal Catfolders traffic and trigger investigations on deviations in request volume or token entropy.
How to Mitigate CVE-2026-19430
Immediate Actions Required
- Upgrade Catfolders Document Gallery Pro to version 2.0.7 or later on every affected WordPress site.
- Audit the plugin's document folders and rotate or relocate any files that may have been exposed while the site ran a vulnerable version.
- Review access logs for prior unauthorized downloads and notify data owners if sensitive files were retrieved.
Patch Information
The vendor addressed the issue in Catfolders Document Gallery Pro version 2.0.7. Refer to the WPScan Vulnerability Report for advisory details and fixed version confirmation.
Workarounds
- Temporarily deactivate the Catfolders Document Gallery Pro plugin until the patched version can be installed.
- Block external access to the plugin's REST API routes at the web server or WAF layer.
- Move sensitive documents out of folders served by the plugin until remediation is verified.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
