Vulnerability · Published May 2, 2026 · Assigned by Wordfence
CVE-2025-14726Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints
Medium 6.5
In plain English
A medium-severity information exposure in Widgets for Social Photo Feed from trustindex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| trustindex | Widgets for Social Photo Feed | 0 – through 1.8 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L