Vulnerability · Published Oct 19, 2026 · Assigned by WPScan
CVE-2026-74922Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
Medium 5.3
In plain English
A medium-severity insufficient verification of data authenticity in Document Gallery from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.1%top 98.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Document Gallery | 4.1 – through 5.1.1 |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/850aaa4e-82ff-479f-bdcd-6cb8089325bd/ exploit, vdb-entry, technical-description