A lack of authorization controls in the CatFolders Document Gallery & PDF Library plugin allows unauthenticated attackers to exfiltrate private media metadata, posing a high risk to information confidentiality.

This vulnerability consists of missing authorization checks within REST API endpoints. Unauthenticated attackers can exploit this flaw to retrieve details such as file titles, types, sizes, and URLs for media attachments, even those residing in restricted or unpublished folders.

While the CVSS score of 7.5 indicates a high severity, the impact is primarily focused on unauthorized information disclosure. By accessing internal media metadata, an attacker can perform reconnaissance against the site infrastructure, potentially identifying sensitive naming conventions or uncovering hidden documents that were intended to remain private. This leads to a loss of data confidentiality and may facilitate more complex, targeted attacks against the organization.

Immediate Action: Update the CatFolders Document Gallery & PDF Library plugin to version 2.0.7 or later to implement the necessary authorization controls.

Proactive Monitoring: Review web server access logs for unusual patterns of requests directed at REST API endpoints associated with the plugin.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to plugin-specific REST API routes if immediate patching is not feasible.

Public Exploit Available: Yes, a public exploit is available.

The vulnerability presents a clear risk to sensitive data exposure. IT administrators should prioritize applying the 2.0.7 security update immediately to ensure that media metadata is protected from unauthorized, unauthenticated access.