CVE-2026-19430 CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...

CVE-2026-19430 CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...

PT-2026-83401

Name of the Vulnerable Software and Affected Versions Catfolders Document Gallery Pro versions prior to 2.0.7 Description Certain REST API routes lack proper authorization, and the token used to identify requested content can be forged on the client side. This allows unauthenticated users to list...