CVE-2026-74923: Unknown Document Gallery

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.

Affected products

• Unknown Document Gallery: up to and including 5.1.1

Published 2026-10-16. Last modified 2026-10-16.