CVE-2026-74923
Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.
| Vendor | unknown |
| Product | document gallery |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown document gallery
Be the first to know when new unknown vulnerabilities affecting unknown document gallery are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Document Gallery
0 ≤ 5.1.1
References
Credits
a0yark WPScan