The vulnerability lies in the CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7, where certain REST API endpoints lack proper authorization checks. As a result, a user who has never logged into the site can send requests to those endpoints and receive the title, type, size, and full URL of every media attachment associated with any folder, including folders that are not published in any gallery. While the data retrieved is limited to metadata, disclosure of file names and URLs can facilitate reconnaissance, aid in identifying sensitive resources, and potentially direct attackers to download files or exploit additional weaknesses if those files are publicly accessible.

Any WordPress site that has installed CatFolders Document Gallery & PDF Library version 2.0.6 or older is affected. The plugin’s authentication is bypassed on several REST API routes, meaning all installations of the older plugin—regardless of site configuration—are vulnerable.

The exploit does not require any credentials and operates purely over HTTP requests to the plugin’s REST API. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exact likelihood of exploitation is unknown, but the lack of authentication allows unrestricted access to sensitive resource metadata. An attacker could use the disclosed information to craft further attacks, such as direct downloads of files or probing for other configuration or code-injection weaknesses. The potential impact is moderate; it does not directly expose file contents but provides actionable information that could lead to higher‑severity exploits. The CVSS score is not provided, so risk assessment must consider the contextual likelihood of an attacker discovering and exploiting these endpoints.