Description
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Media Modification
Action: Immediate Patch
AI Analysis

Impact

The Document Gallery WordPress plugin through version 5.1.1 does not validate the cryptographic signature on its unauthenticated webhook endpoint when no shared secret is configured, the default state. This omission allows any unauthenticated user to send a request that replaces the thumbnail image published for any document on the site. The impact is the unauthorized alteration of media content, which can be used for defacement or misleading branding, compromising the integrity of the site’s visual information.

Affected Systems

The vulnerability affects the Document Gallery WordPress plugin for all releases from 4.1 up to and including 5.1.1. Any WordPress site that has one of these versions installed is susceptible, regardless of other plugins or themes.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely via HTTP requests to the webhook endpoint, with no authentication required. An attacker can trivially craft a request to replace the thumbnail image, making the exploit straightforward for both automated scripts and manual tests.

Generated by OpenCVE AI on October 19, 2026 at 13:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest available patch or upgrade to Document Gallery 5.1.2 or later.
  • Configure a shared secret for the Thumber webhook to enable signature verification.
  • If an immediate patch is not possible, restrict access to the webhook endpoint using firewall rules, IP whitelisting, or web server authentication to prevent unauthenticated requests.

Generated by OpenCVE AI on October 19, 2026 at 13:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-345
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Mon, 19 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.
Title Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-19T09:31:21.524Z

Reserved: 2026-08-17T11:27:43.418Z

Link: CVE-2026-74922

cve-icon Vulnrichment

Updated: 2026-10-19T09:25:24.350Z

cve-icon NVD

Status : Received

Published: 2026-10-19T07:16:31.760

Modified: 2026-10-19T10:16:48.870

Link: CVE-2026-74922

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:00:16Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity