CVE-2026-74922
Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 19, 2026
- Updated
- Oct 19, 2026
- Reserved
- Aug 17, 2026
Description
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | WPScan |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
Document GalleryUnknown |
|
References
- https://wpscan.com/vulnerability/850aaa4e-82ff-479f-bdcd-6cb8089325bd/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.