What is the CVSS score of CVE-2026-19717?

CVE-2026-19717 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of CatFolders WordPress Plugin are affected by CVE-2026-19717?

CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows unauthenticated external parties to enumerate and access metadata-including file titles, types, sizes, and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-19717?

Yes, a public proof-of-concept exploit is available for CVE-2026-19717. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-19717?

Within 24 hours, identify all WordPress installations running CatFolders and inventory which document repositories are configured; within 7 days, update all affected WordPress sites to CatFolders 2.0.7 or later; within 30 days, audit access logs for suspicious REST API queries, assess what document metadata may have been exposed to unauthorized parties, and implement additional access controls such as IP whitelisting or authentication requirements on sensitive API endpoints.

CatFolders WordPress Plugin CVE-2026-19717

EUVD-2026-59917 HIGH

Information Exposure (CWE-200)

2026-08-16 WPScan

GHSA-5mhj-h5rp-p5mp

WordPress Information Disclosure Catfolders Document Gallery Pdf Library Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Exposure is limited to file metadata and URLs, not file content directly, warranting C:L over C:H; all other metrics match the trivially exploitable network vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 20:23 vuln.today

CVSS changed

Aug 17, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Aug 16, 2026 - 07:01 EUVD

CVE Published

Aug 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 16, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.

AnalysisAI

Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.

Technical ContextAI

The affected component is the CatFolders Document Gallery & PDF Library WordPress plugin (CPE: cpe:2.3:a:unknown:catfolders_document_gallery_&_pdf_library:*:*:*:*:*:*:*:*), a plugin that organizes WordPress media attachments into folder-based galleries. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - specifically, WordPress REST API endpoints registered by the plugin lack the standard permission_callback checks required to enforce authentication or capability validation. In the WordPress REST API architecture, omitting or misconfiguring permission_callback defaults to unrestricted public access. This allows any unauthenticated HTTP client to call the affected endpoints and receive metadata (title, MIME type, file size, and direct URL) for media attachments across all plugin-managed folders, including those intentionally kept off public galleries.

RemediationAI

The primary fix is to update the CatFolders Document Gallery & PDF Library plugin to version 2.0.7 or later, which is available from the WordPress plugin repository per the vendor advisory referenced at https://wpscan.com/vulnerability/79a4bae6-96e2-44b4-a56b-42198f8b3d32/ and tracked at https://nvd.nist.gov/vuln/detail/CVE-2026-19717. If immediate patching is not feasible, a compensating control is to use a Web Application Firewall (WAF) rule to block unauthenticated requests to the plugin's REST API namespace (typically /wp-json/catfolders/ or equivalent) - this prevents exploitation but will also break legitimate unauthenticated API consumers if any exist, so validate before deploying. Alternatively, disabling the WordPress REST API for unauthenticated users site-wide (via a security plugin such as Wordfence or custom code adding a rest_authentication_errors filter) blocks this attack vector but may affect other plugins or themes relying on public REST access.