WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure
CVE-2025-14726
Verified
Description
Widgets for Social Photo Feed WordPress plugin <= 1.8 contains a broken access control caused by missing capability checks on specific REST API endpoints, letting unauthenticated attackers access and modify plugin settings remotely.
Severity
Medium
CVSS Score
6.5
Exploit Probability
1%
Published Date
May 6, 2026
Template Author
0x_akoko
CVE-2025-14726.yaml
6.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVE ID:
cve-2025-14726
CWE ID:
cwe-200, cwe-862
References
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/social-photo-feed-widget/widgets-for-social-photo-feed-18-missing-authentication-to-unauthenticated-plugin-settings-accessupdate-via-trustindex-feed-hook-instagram-rest-api-endpointshttps://wordpress.org/plugins/social-photo-feed-widget/https://nvd.nist.gov/vuln/detail/CVE-2025-14726
Remediation Steps
Update to the latest version beyond 1.8