{"vulnerability": "CVE-2026-74923", "sightings": [{"uuid": "5ef9e854-d32a-4d3f-b236-d3cdb3d4f3b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74923", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117449181963691764", "content": "CVE-2026-74923 Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.\nhttps://www.cve.org/CVERecord?id=CVE-2026-74923https://wpscan.com/vulnerability/23254461-f638-4fb7-817b-776c0db18a67/#CVE_2026_74923#bot", "creation_timestamp": "2026-10-16T06:31:33.542191Z"}]}