What is GHSA-wpx6-cwp7-w9hm?

GHSA-wpx6-cwp7-w9hm is a security advisory published by GitHub Security Advisories with Medium severity. The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its...

Which CVE IDs does GHSA-wpx6-cwp7-w9hm cover?

GHSA-wpx6-cwp7-w9hm covers the following CVE IDs: CVE-2026-74922. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wpx6-cwp7-w9hm?

GHSA-wpx6-cwp7-w9hm has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-wpx6-cwp7-w9hmMediumCVSS 5.3

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its...

Vendor

GitHub Security Advisories

Published

October 19, 2026

Last Modified

October 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-74922 →

📋 Description

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-74922
https://wpscan.com/vulnerability/850aaa4e-82ff-479f-bdcd-6cb8089325bd
https://github.com/advisories/GHSA-wpx6-cwp7-w9hm