medium5.3
CVE-2026-74922
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has bee…
Impact
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.
Affected products
| Product | Affected versions |
|---|---|
| Document Gallery WordPress Plugin | through 5.1.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.