CVE-2025-14726
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.
Risk Assessment
Unauthenticated attackers can read and modify plugin settings, potentially leading to further attacks or data exposure. Organizations using this plugin are at risk of manipulation.
Recommendation
Update the Widgets for Social Photo Feed plugin to a version newer than 1.8 or remove it if not in use.
Other vulnerabilities in Widgets for Social Photo Feed
Original NVD description (English source)
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS