boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-19717HIGH
Unknown CatFolders Document Gallery & PDF Library — CatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST API
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0035   27.7     —
AFFECTED
  Product                                    Versions     Fixed
  CatFolders Document Gallery & PDF Library  unspecified  —
TIMELINE
  Aug 13  Reserved by WPScan
  Aug 15  EXPLOIT PUBLISHED — CVE-2026-19717 (Unknown CatFolders Document Gallery & PDF Library). Public exploit reference added.
  Aug 16  Published (CNA: WPScan)
CWE-200 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

Description

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
August 13, 2026ReservedReserved by WPScan
August 15, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-19717 (Unknown CatFolders Document Gallery & PDF Library). Public exploit reference added.
August 16, 2026PublishedPublished (CNA: WPScan)

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
UnknownCatFolders Document Gallery & PDF Library———

Weaknesses

CWE-200

References (1)

Related

Authoritative record: CVE-2026-19717 at cve.org

Weaknesses: CWE-200

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19717 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.