{"id":"CVE-2026-74923","kind":"vulnerability","aliases":["CVE-2026-74923"],"related":[],"title":"Document Gallery WordPress plugin leaks private media titles and file URLs","description":"The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.","summary":"The Document Gallery WordPress plugin through 5.1.1 skips permission checks when it builds a gallery on demand. An unauthenticated visitor can list titles, descriptions and direct file URLs of media attached to unpublished, private or trashed posts.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-above-5.1.1","plugin-not-installed"],"how_to_check":"- Check whether the Document Gallery plugin is installed and at what version, under Plugins in the WordPress admin or in `wp-content/plugins/`\n- Confirm the plugin version is `5.1.1` or earlier","fix":"- Update the Document Gallery plugin to a version later than `5.1.1`\n- If no fixed version exists, deactivate the plugin or restrict its gallery endpoint at the web server\n- Rotate any sensitive files that were attached to private or trashed content","status":"open","published_at":"2026-10-16T07:17:13+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:34+00:00","updated_at":"2026-10-25T04:28:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:28:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Document Gallery plugin to a version later than `5.1.1`\n- If no fixed version exists, deactivate the plugin or restrict its gallery endpoint at the web server\n- Rotate any sensitive files that were attached to private or trashed content","reach":"internet","title":"Document Gallery WordPress plugin leaks private media titles and file URLs","impact":"low","summary":"The Document Gallery WordPress plugin through 5.1.1 skips permission checks when it builds a gallery on demand. An unauthenticated visitor can list titles, descriptions and direct file URLs of media attached to unpublished, private or trashed posts.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated visitors read private document titles and file URLs","analyst_note":"Check the plugin's changelog or the NVD entry for the first fixed version and whether a gallery setting must be enabled.","how_to_check":"- Check whether the Document Gallery plugin is installed and at what version, under Plugins in the WordPress admin or in `wp-content/plugins/`\n- Confirm the plugin version is `5.1.1` or earlier","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-5.1.1"],"who_is_affected":"Sites running the Document Gallery plugin at version 5.1.1 or earlier that attach documents to unpublished, private or trashed content. Sites that do not use the plugin, or that only attach public media, have less to lose but should still update. The sources do not say whether the flaw needs a particular gallery setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3312,"output_tokens":622,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-74923':14A,17A '5.1.1':32B,69C 'allow':84C 'attach':56B,100C 'build':38B 'capabl':74C 'check':35B,77C 'content':106C 'cve':12A,15A 'demand':42B,83C 'descript':49B,93C 'direct':51B,95C 'disclos':90C 'document':1A,27B,64C 'enumer':88C 'file':10A,52B,96C 'galleri':2A,28B,40B,65C,81C 'generat':79C 'host':21B 'leak':5A 'list':47B 'media':7A,55B,99C 'ownership':76C 'packag':18B 'perform':72C 'permiss':34B 'plugin':4A,25B,30B,67C 'post':62B 'privat':6A,59B,103C 'self':20B 'self-host':19B 'skip':33B 'titl':8A,48B,92C 'trash':61B,105C 'unauthent':44B,85C 'unpublish':58B,102C 'url':11A,53B,97C 'user':86C 'visitor':45B 'wordpress':3A,22B,24B,29B,66C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Document Gallery plugin at version 5.1.1 or earlier that attach documents to unpublished, private or trashed content. Sites that do not use the plugin, or that only attach public media, have less to lose but should still update. The sources do not say whether the flaw needs a particular gallery setting.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74923","severity":null,"published_at":"2026-10-16T07:17:13+00:00","modified_at":"2026-10-16T15:17:32+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}