CVE-2026-74922 Document Gallery CVE debrief

Who should care

Site administrators using the Document Gallery WordPress plugin should assess their exposure and verify plugin configuration to prevent potential thumbnail replacement. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-74922 is a medium-severity vulnerability in the Document Gallery WordPress plugin that allows unauthenticated users to replace document thumbnails when no shared secret is configured. Defenders should prioritize verifying plugin configuration and updating to a fixed version if available.

• Defenders should verify plugin configuration to prevent unauthorized thumbnail replacements.
• Site administrators may need to update to a fixed version of the plugin.
• Further investigation is needed to determine the full scope of affected systems.

Technical summary

The Document Gallery WordPress plugin through version 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, allowing unauthenticated users to replace the thumbnail image published for any document. The vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. The plugin's unauthenticated webhook endpoint does not verify signatures when no shared secret has been configured, allowing unauthenticated users to replace document thumbnails.

Defensive priority

Defenders should prioritize verifying plugin configuration and updating to a fixed version if available.

Recommended defensive actions

• Verify the Document Gallery WordPress plugin configuration to ensure a shared secret is set.
• Monitor for potential unauthorized thumbnail replacements.
• Consider updating to a fixed version of the plugin if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to determine the full scope of affected systems and potential impact. The vulnerability affects the Document Gallery WordPress plugin through version 5.1.1. The plugin's unauthenticated webhook endpoint does not verify signatures when no shared secret has been configured, allowing unauthenticated users to replace the thumbnail image published for any document. The CVE Program record and NVD detail page provide additional

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.