Document Gallery CVE-2026-74922

Exploitable only when no shared secret has been configured for the plugin's webhook endpoint - which the description states is the default state - so default installations of Document Gallery through 5.1.1 are vulnerable out of the box. The specific prerequisite is that the affected unauthenticated webhook endpoint be reachable and that signature verification be effectively disabled by the missing shared secret. The principal limiting factor is that configuring a shared secret (enabling signature verification) closes the hole, and impact is confined to replacing a document's published thumbnail image (no code execution, data read, or availability loss per I:L/C:N/A:N).

Signals are internally consistent and point to a genuine but low-severity integrity issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) confirms remote, low-complexity, unauthenticated exploitation against the default configuration, matching the description's statement that no shared secret is set by default. Impact is limited to Integrity:Low (C:N/A:N) - the attacker can only swap the published thumbnail image, not read data or disrupt availability. Public exploit code exists (WPScan), which raises the likelihood of opportunistic scanning, but the CVE is NOT on the CISA KEV list and no EPSS score was provided in the input, so there is no evidence of confirmed active exploitation. No SSVC decision data was supplied. Net: easy to exploit and publicly documented, but the low real-world impact (cosmetic/defacement of a thumbnail) keeps this as a routine patch-cycle item for most defenders rather than an urgent fix - prioritize it higher only where thumbnail integrity has reputational or phishing/defacement consequences. Note the input Tag 'Information Disclosure' conflicts with the CVSS vector and description, which describe an integrity/content-replacement flaw (C:N, I:L), not disclosure.

An attacker enumerates WordPress sites running Document Gallery <=5.1.1 and sends a forged request to the plugin's unauthenticated webhook endpoint, which skips signature verification because no shared secret is configured (the default). Because public exploit code is available via WPScan and no authentication or user interaction is required, the attacker replaces the thumbnail image the site publishes for a chosen document, enabling defacement or deceptive imagery at scale.