Live › vulnerability › CVE-2026-74922
Go to dashboardThe Document Gallery WordPress plugin through 5.1.1 accepts calls to one of its unauthenticated webhook endpoints without checking a signature when no shared secret is set, which is the default. An anonymous visitor can therefore replace the thumbnail image the site shows for any document.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Document Gallery WordPress plugin version 5.1.1 or earlier that use its webhook endpoint with no shared secret configured, which is the default state. Sites that have set a shared secret, or that do not run this plugin, are not exposed by this issue. The sources do not describe further conditions.
No product ranges from the sources yet.
wp plugin get document-gallery --field=version (plugin slug unknown from sources; confirm in the WordPress admin plugin list).5.1.1 once a fixed release is published (fixed version unknown from sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.
This page as .md · .json · in your agent: get_signal("CVE-2026-74922")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.