WordPress Document Gallery plugin 4.1-5.1.1 - Unauthenticated Document Thumbnail Replacement vulnerability

Unauthenticated Document Thumbnail Replacement vulnerability discovered by Artus KG in WordPress Plugin Document Gallery versions 4.1-5.1.1...

CVE-2026-74922 Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

CVE-2026-74922 Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

CVE-2026-74922

The Document Gallery WordPress plugin, affecting versions 4.1 through 5.1.1 , is vulnerable to an unauthenticated document thumbnail replacement . This issue occurs because the plugin fails to verify signatures on a specific unauthenticated webhook endpoint when no shared secret is configured, wh...