CyberRota Analysis
AI-GeneratedThe Catfolders Document Gallery Pro plugin for WordPress prior to version 2.0.7 has a vulnerability that allows unauthenticated users to exploit improperly authorized REST API routes, enabling them to list and download unpublished folder contents. This poses a significant risk to site confidentiality, potentially exposing sensitive documents. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.