CVE-2025-14726CWE-200information-disclosure

CVE-2025-14726

Medium · published May 2, 2026

CVSS v3.1

6.5

EPSS

Percentile

57.1

In the wild

Unconfirmed

What it is

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00830 · 57.1th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2026-05-02T09:16Z

References (2)

https://plugins.trac.wordpress.org/changeset/3513612/social-photo-feed-widget · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/ab15fa8b-4072-435a-8a1c-ca6fd964a260?source=cve · [email protected]

EPSS history

Timeline

02 MAY 04:27Z
Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints
cvelistv5