The Document Gallery WordPress plugin, versions up to 5.1.1, does not perform a capability or ownership check when generating a gallery on demand, allowing any unauthenticated visitor to retrieve the titles, descriptions, and direct URLs of media files attached to unpublished, private, or trashed posts. This lack of access control and the resulting exposure of internal media metadata (CWE‑200) create a significant information‑disclosure risk. Based on the description, it is inferred that the attack involves sending a request to the publicly accessible dg_generate_gallery or dg_generate_icons endpoint without credentials, which is how the vulnerability is exploited.

Any WordPress site that has the Document Gallery plugin version 5.1.1 or earlier installed is affected; vendor details are listed as Unknown:Document Gallery, but the flaw applies to all installations of that plugin regardless of provider.

Based on the description, it is inferred that the vulnerability is accessed via a public endpoint that requires no credentials, offering a zero‑barrier exploitation path. The EPSS score of < 1% indicates a low likelihood of exploitation currently, and the flaw is not listed in the CISA KEV catalog; nevertheless, the ability to enumerate private media contents presents a high‑risk information‑disclosure scenario. The CVSS score of 5.3 indicates moderate severity.