CVE-2026-74922

MediumCVSS 5.3/10Last modified Oct 19, 2026

Description

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-749235.3The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, CVE-2026-749257.2The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding i CVE-2026-749267.1The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes CVE-2026-749275.3The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing CVE-2026-749287.5The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated user CVE-2026-749295.4The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allow CVE-2026-74935.3The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in al CVE-2026-749304.3The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the requ CVE-2026-749327.5The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it CVE-2026-749338.8The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decod CVE-2026-749347.5Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 14 CVE-2026-749358.8Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14,