CVE-2026-74922: Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure a shared secret for the unauthenticated webhook endpoint so webhook signatures are verified.
Document Gallery WordPress plugin webhook shared secret = configured
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Document Gallery installations through version 5.1.1 are exposed when no shared secret is configured for the affected Thumber webhook endpoint. The description states that this is the default configuration.
What does an attacker need to exploit this issue?
An attacker does not need authentication, user interaction, or a configured account. They can exploit the unauthenticated webhook endpoint when its signature verification is bypassed because no shared secret has been set.
What can an attacker change?
An attacker can replace the thumbnail image that the site publishes for any document. The provided information does not indicate that document contents or other site data can be modified.
What can be done if updating is not immediately possible?
Configure a shared secret for the affected webhook so that signature verification is not bypassed in the default no-secret state. This directly addresses the condition described for exploitation.