The CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 contains REST API endpoints that lack proper authorization checks. As a result, any user who has not authenticated to the site can send HTTP requests to those endpoints and receive the title, type, size and full URL of media attachments in any folder, including folders that are not displayed in a gallery. This weakness is an example of information disclosure (CWE‑200). The disclosed metadata does not reveal file contents, but it allows an attacker to identify potentially sensitive files, map the site’s file structure, and plan further attacks if those files are publicly reachable.

Any WordPress installation that has the CatFolders Document Gallery & PDF Library plugin deployed in a version older than 2.0.7 is subject to this vulnerability. The vendor for the plugin is listed as Unknown, but the product name is CatFolders Document Gallery & PDF Library. No additional vendor or product names are included in the supplied data.

The flaw can be exploited without any credentials or prior access and operates solely over standard HTTP calls to the plugin’s REST API. The CVSS score of 7.5 indicates high severity, and the EPSS score is reported as less than 1 % (suggesting a low but non‑zero probability of exploitation). The vulnerability is currently not listed in the CISA KEV catalog. Because the REST endpoint returns only metadata, the direct impact is limited to possible reconnaissance and subsequent targeted attacks. Nonetheless, the lack of authorization makes the plugin’s data readily accessible to any Internet user.