CVE-2025-10637CWE-862broken-access-control

CVE-2025-10637

Medium · published October 25, 2025

CVSS v3.1

5.3

EPSS

Percentile

22.1

In the wild

Unconfirmed

What it is

The Social Feed Gallery plugin for WordPress is vulnerable to Information Exposure in versions less than, or equal to, 4.9.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate Instagram profile and media data from any account the site owner connected to their site.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00304 · 22.1th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-10-25T11:15Z

References (4)

https://plugins.trac.wordpress.org/browser/insta-gallery/tags/4.9.2/lib/api/rest/endpoints/frontend/class-user-profile.php#L19 · [email protected]https://plugins.trac.wordpress.org/changeset/3381423/insta-gallery/trunk/lib/api/rest/endpoints/frontend/class-user-profile.php · [email protected]https://wordpress.org/plugins/insta-gallery/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/ae0dd6b0-9028-456e-9843-d45754c01c53?source=cve · [email protected]

EPSS history

Timeline

25 OCT 06:49Z
Social Feed Gallery <= 4.9.2 - Missing Authorization to Unauthenticated Information Exposure
cvelistv5