CVE-2026-74923 Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed...

CVE-2026-74923

The Document Gallery WordPress plugin (versions through 5.1.1 ) is vulnerable to an unauthenticated non-public attachment disclosure vulnerability. The root cause is a lack of capability or ownership checks when the plugin generates a gallery on demand via the dg_generate_gallery and dg_generate_...