{"id":"CVE-2026-74922","kind":"vulnerability","aliases":["CVE-2026-74922"],"related":[],"title":"Document Gallery WordPress plugin: unauthenticated webhook lets anyone replace thumbnails","description":"The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.","summary":"The Document Gallery WordPress plugin through 5.1.1 accepts calls to one of its unauthenticated webhook endpoints without checking a signature when no shared secret is set, which is the default. An anonymous visitor can therefore replace the thumbnail image the site shows for any document.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-gallery","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","shared-secret-configured"],"how_to_check":"- Check whether the Document Gallery plugin is installed and what version it reports, for example `wp plugin get document-gallery --field=version` (plugin slug unknown from sources; confirm in the WordPress admin plugin list).\n- Check whether a shared webhook secret is configured in the plugin settings; the sources say the default state has none set.","fix":"- Update the Document Gallery plugin to a version later than `5.1.1` once a fixed release is published (fixed version unknown from sources).\n- Until updated, set a shared webhook secret in the plugin settings or disable the webhook endpoint (exact setting name unknown from sources).","status":"open","published_at":"2026-10-19T07:16:31+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:34+00:00","updated_at":"2026-10-25T04:26:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Document Gallery plugin to a version later than `5.1.1` once a fixed release is published (fixed version unknown from sources).\n- Until updated, set a shared webhook secret in the plugin settings or disable the webhook endpoint (exact setting name unknown from sources).","reach":"internet","title":"Document Gallery WordPress plugin: unauthenticated webhook lets anyone replace thumbnails","impact":"low","summary":"The Document Gallery WordPress plugin through 5.1.1 accepts calls to one of its unauthenticated webhook endpoints without checking a signature when no shared secret is set, which is the default. An anonymous visitor can therefore replace the thumbnail image the site shows for any document.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","document-gallery"],"confidence":0.7,"needs_auth":"no","worst_case":"anonymous visitors replace published document thumbnails on the site","analyst_note":"Confirm the fixed version and the webhook endpoint or setting name from the NVD entry or plugin changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-74922.","how_to_check":"- Check whether the Document Gallery plugin is installed and what version it reports, for example `wp plugin get document-gallery --field=version` (plugin slug unknown from sources; confirm in the WordPress admin plugin list).\n- Check whether a shared webhook secret is configured in the plugin settings; the sources say the default state has none set.","needs_analyst":true,"not_affected_if":["plugin-not-installed","shared-secret-configured"],"who_is_affected":"Sites running the Document Gallery WordPress plugin version 5.1.1 or earlier that use its webhook endpoint with no shared secret configured, which is the default state. Sites that have set a shared secret, or that do not run this plugin, are not exposed by this issue. The sources do not describe further conditions.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":3312,"output_tokens":708,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-74922':13A,16A '5.1.1':31B,76C 'accept':32B 'allow':101C 'anonym':56B 'anyon':8A 'call':33B 'check':42B 'configur':95C 'cve':11A,14A 'default':54B,99C 'document':1A,18B,26B,69B,71C,114C 'document-galleri':17B 'endpoint':40B,88C 'galleri':2A,19B,27B,72C 'imag':63B,108C 'let':7A 'one':35B,83C 'packag':20B 'plugin':4A,24B,29B,74C 'publish':111C 'replac':9A,60B,105C 'secret':48B,92C 'set':50B 'share':47B,91C 'show':66B 'signatur':44B,81C 'site':65B,110C 'state':100C 'therefor':59B 'thumbnail':10A,62B,107C 'unauthent':5A,38B,86C,102C 'user':103C 'verifi':79C 'visitor':57B 'webhook':6A,39B,87C 'without':41B 'wordpress':3A,21B,23B,28B,73C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Document Gallery WordPress plugin version 5.1.1 or earlier that use its webhook endpoint with no shared secret configured, which is the default state. Sites that have set a shared secret, or that do not run this plugin, are not exposed by this issue. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74922","severity":null,"published_at":"2026-10-19T07:16:31+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}