CVE-2026-74922

Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2

Description The plugin fails to verify the signature on an unauthenticated webhook endpoint when no shared secret is configured, which is the default setting. This allows unauthenticated users to replace the thumbnail image published for any document.

Recommendations Update the Document Gallery WordPress plugin to version 5.1.2 or later. Configure a shared secret for the webhook endpoint to ensure signature verification is active.