What is CVE-2026-19430?

CVE-2026-19430 is a medium-severity vulnerability in Catfolders Document Gallery Pro, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-08-29.

How severe is CVE-2026-19430?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Catfolders Document Gallery Pro

CVE-2026-19430

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.

Vulnerability class: Broken Access Control

EPSS: 0.001 (3.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Unknown Catfolders Document Gallery Pro

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-19430?: CVE-2026-19430 is a medium-severity vulnerability in Catfolders Document Gallery Pro, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-08-29.
How severe is CVE-2026-19430?: Medium severity. CVSS v3 base score is 5.3 out of 10.