What’s Vulnerable › Vulnerabilities
CVE-2026-74922: Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-19 · updated 2026-10-19
- Weakness: CWE-345
Description
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.
Affected products
- Document Gallery: from 4.1 through 5.1.1
References
Get alerted when CVE-2026-74922 or the next vulnerability affects your stack