CVE-2026-74923 in Document Gallery Plugin
Summary
by MITRE • 10/16/2026
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Document Gallery WordPress plugin versions up through 5.1.1 represents a critical failure in access control mechanisms within the application's dynamic gallery generation logic. This flaw stems from an insufficient verification process where the software fails to validate user permissions or ownership rights before processing requests for media content. Specifically, when the plugin generates a gallery on demand via its administrative-ajax interface, it does not check whether the requesting user has the necessary capabilities to view the associated posts or attachments. Consequently, any unauthenticated visitor can interact with this endpoint and retrieve metadata such as titles, descriptions, and direct file URLs for media items that are strictly intended to be hidden from public access, including those attached to unpublished drafts, private pages, or trashed content.
From a technical perspective, the root cause is classified under CWE-284 Improper Access Control, specifically reflecting an authorization bypass where the application relies on client-side assumptions rather than server-side validation of user privileges. The vulnerability allows for information disclosure through enumeration, as attackers can systematically request gallery data to map out the structure and contents of a WordPress installation without needing valid credentials. This behavior aligns with ATT&CK technique T1087 Account Discovery, where adversaries gather account-related information from local systems or network services, although in this context it extends to content discovery within the web application environment. The lack of checks for post status (such as private or draft) and attachment permissions means that sensitive documents intended only for specific user groups are exposed via direct URLs, facilitating further attacks such as credential harvesting if login pages are linked, or data exfiltration if confidential files like PDFs or spreadsheets are stored in these directories.
The operational impact of this vulnerability is significant, particularly for websites handling proprietary information, customer data, or internal communications. By exposing private and unpublished content, the organization risks violating data protection regulations such as GDPR or HIPAA depending on the nature of the disclosed material. Attackers can leverage the discovered file URLs to download sensitive documents directly from the web server's public directory structure, bypassing any frontend restrictions that might otherwise hide these files from casual browsing. This exposure undermines the confidentiality integrity and availability principles of information security, potentially leading to reputational damage, legal liabilities, and loss of competitive advantage if trade secrets or strategic plans are leaked through this vector.
Mitigation strategies must focus on enforcing strict server-side access controls within the plugin's AJAX handler code. Developers should implement capability checks using WordPress functions such as current_user_can() to ensure that only users with appropriate roles, like administrators or authors depending on context, can request gallery data for specific posts. Additionally, ownership verification should be performed to confirm that the requesting user is either the author of the post or has explicit permission to view private content. For immediate remediation without code modification, site administrators should consider restricting access to the wp-admin-ajax.php endpoint via web application firewall rules if possible, although this may impact legitimate functionality. Upgrading to a patched version of the plugin that corrects these authorization checks is the most effective long-term solution, ensuring that all media requests are validated against user permissions and post visibility settings before any data is returned to the client.