What is the CVSS score of EUVD-2026-102686?

EUVD-2026-102686 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-102686?

Yes, a public proof-of-concept exploit is available for EUVD-2026-102686. Prioritise patching immediately. EPSS: 0.1%.

Document Gallery EUVD-2026-102686

| CVE-2026-74923 MEDIUM

Information Exposure (CWE-200)

2026-10-16 WPScan

GHSA-gpqc-hmwj-8jjg

WordPress Information Disclosure Document Gallery

5.3

CVSS 3.1 · Vendor: WPScan

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site running Document Gallery ≤5.1.1
Delivery

Send unauthenticated gallery-generation request
Exploit

Bypass missing capability/ownership check
Execution

Enumerate media of private/unpublished/trashed content
Impact

Harvest titles, descriptions and direct file URLs

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The target must run the Document Gallery WordPress plugin version 5.1.1 or earlier, and the vulnerable behavior is the on-demand gallery generation path, which performs no capability or ownership check. No authentication, user interaction, or special configuration is required (AV:N/AC:L/PR:N/UI:N) - exploitation works against default installations. The only real limiting factor on impact is data-dependent: the attacker gains value only if the site actually has media attached to unpublished, private, or trashed content worth disclosing; sites with no sensitive draft/private attachments leak little of consequence.
Impact	This is a genuine but moderate-severity information-disclosure flaw, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N = 5.3 MEDIUM) is internally consistent with the description: a remote, unauthenticated attacker can trigger on-demand gallery generation with low attack complexity and no user interaction, gaining limited confidentiality impact (metadata and file URLs) with no integrity or availability impact. Multi-source signals largely agree rather than conflict: EPSS is low at 0.14% (3rd percentile), the CVE is NOT on CISA KEV, yet a public exploit/write-up exists via WPScan - meaning exploitability is proven but mass exploitation is not currently measured. The low EPSS alongside confirmed POC availability is normal for a recently disclosed, low-impact WordPress plugin bug: the capability exists but has not driven observed widespread scanning. The confidentiality impact is correctly scoped as Low (C:L) because only titles, descriptions, and direct media URLs of non-public content leak - not full account or site compromise - so despite easy unauthenticated access, real-world risk is bounded by what data the leaked media actually contains.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted request to the Document Gallery on-demand gallery-generation endpoint on a target WordPress site, causing it to render media attached to unpublished, private, or trashed posts. A public exploit/write-up from WPScan exists, so the request format is known. The attacker harvests the titles, descriptions, and direct file URLs, then downloads sensitive draft or private documents directly.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 16, 2026

Unauthenticated information disclosure in the Document Gallery WordPress plugin through 5.1.1 lets any remote visitor generate a gallery on demand and read back the titles, descriptions, and direct file URLs of media attached to unpublished, private, or trashed posts. Because the on-demand gallery path performs no capability or ownership check, the issue is reachable on default installations with no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); publicly available exploit code exists, so scanning and opportunistic abuse are plausible, although no confirmed active exploitation (CISA KEV) has been recorded and EPSS puts likelihood low at roughly 0.14% (3rd percentile). Impact is bounded: the leak is confidentiality-only and data-dependent - sites that keep no sensitive media attached to drafts, private, or trashed content expose little of consequence, which is why our independent assessment rates this as a genuine but moderate-severity flaw rather than a critical priority.

RemediationAI

No vendor-released patch is identified in the available intelligence - the references provided are the WPScan exploit/advisory entry and the NVD record only - so no fixed version number can be cited and administrators should verify the plugin's current release before assuming it is safe. The most reliable mitigation is to deactivate and, where practical, remove the Document Gallery plugin until an upstream fix is confirmed, accepting the loss of gallery functionality as the trade-off. If the plugin must remain active, reduce exposure by deleting the underlying sensitive data set: publish or delete stale drafts, empty the trash, and remove or relocate media attachments belonging to private or unpublished posts so there is little to enumerate - this costs workflow convenience but neutralizes the data-dependent portion of the risk. Front-end galleries that are intended to be public will continue to render, so this will not break ordinary rendering. Where a WAF or reverse proxy is available, block unauthenticated requests that reach the plugin's on-demand gallery endpoint and return attachment metadata (for example direct requests into the plugin directory or admin-ajax.php calls carrying the plugin's gallery action) and alert on rapid sequential enumeration of uploads URLs; the trade-off is that legitimate anonymous visitors may lose dynamically generated galleries, so the rule should be tuned or limited to suspicious request patterns. Additionally, monitor web and proxy logs for bulk access to attachment URLs from single source IPs, and treat any such pattern as confirmation that the site's draft/private media metadata has been harvested. Reverse the decision to keep the plugin only after confirming an upstream release that restores capability and ownership checks on the on-demand generation path.

Affected VersionsENISA

Document Gallery 0 ≤5.1.1

Affected Packages

euvd document_gallery no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Document Gallery is a WordPress plugin that builds document/media galleries at runtime rather than only at save time. The vulnerable behavior is that on-demand generation does not call the standard WordPress authorization primitives - no current_user_can() capability check and no post-ownership/post-status check - before resolving and returning attachment metadata. This is a classic CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (an access-control gap manifesting as information disclosure): the handler trusts the caller and simply returns attachment titles, descriptions, and direct file URLs, including items whose parent posts are unpublished (draft/pending), private, or in the trash, which WordPress normally hides from anonymous visitors. The CPE entry is recorded with an unknown vendor namespace (cpe:2.3:a:unknown:document_gallery), reflecting that the plugin is distributed outside the usual vendor CPE mapping; the ENISA EUVD record (EUVD-2026-102686) lists affected versions as Document Gallery 0 through 5.1.1. The referenced WPScan entry functions as the exploitability reference, and our independent vector confirms the unauthenticated, network-reachable, no-interaction profile (PR:N/UI:N). Note that the underlying weakness is enumeration of metadata and direct file URLs; the associated files themselves are served from the WordPress uploads directory, so disclosure of the URL is the effective disclosure of the object unless the uploads path is otherwise protected.

Know when Document Gallery gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (WPScan) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 5.3 MEDIUM

Remote unauthenticated access with no user interaction (AV:N/AC:L/PR:N/UI:N); limited metadata/URL disclosure only, so C:L with I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Oct 16, 2026 - 15:23 NVD

5.3 (MEDIUM)

CVE Published

Oct 16, 2026 - 06:00 cve.org

MEDIUM 5.3

CVE Published

Oct 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.

Threat Intelligence Overview

EPSS Score

0.1%

Top 97% exploitable

Prevalence

Low

niche WordPress document-display plugin, modest install base

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.