CVE-2026-74922: Document Gallery 4.1 through 5.1.1

Affected technology

Document Gallery · 4.1 through 5.1.1
Vendor not specified by the source

Description’s affected range: through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says the Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document. Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low.