CVE-2026-19717

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 lacks authorisation checks on certain REST API endpoints, allowing unauthenticated attackers to enumerate and retrieve the title, type, size and URL of all media attachments, including unpublished folders. No in-the-wild ...