CVE-2025-14726: 
WordPress vulnerability analysis and mitigation

CVE-2025-14726 is a missing authorization vulnerability in the Widgets for Social Photo Feed plugin for WordPress, developed by Trustindex. The flaw allows unauthenticated attackers to access and modify plugin settings via two unprotected REST API endpoints. All versions up to and including 1.8 are affected. It was published on May 2, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Wordfence).

The root cause is a missing capability check (CWE-862 / CWE-200) on two REST API endpoints registered by the plugin: /trustindex_feed_hook_instagram/troubleshooting and /trustindex_feed_hook_instagram/submit-data. Because these endpoints lack proper WordPress capability verification, any unauthenticated network request can invoke them without credentials or user interaction. An attacker simply sends HTTP requests to these endpoints to read or overwrite plugin configuration data. A Nuclei detection template has been added to the ProjectDiscovery nuclei-templates repository, indicating automated scanning tooling is available (GitHub Advisory, Wordfence).

Successful exploitation allows unauthenticated attackers to read sensitive plugin configuration data and overwrite plugin settings, impacting both integrity and availability of the plugin's functionality. An attacker could alter Instagram feed configurations, potentially redirecting displayed content or disrupting the plugin's operation on affected WordPress sites. While confidentiality impact is rated None in the CVSS score, the CWE-200 classification indicates some exposure of plugin-internal data through the troubleshooting endpoint. Lateral movement risk is limited, but misconfigured plugin settings could be leveraged to degrade site functionality or facilitate social engineering (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time (Wordfence). However, the vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 3.23–3.34%, placing it in the 88th percentile for exploitation likelihood within 30 days (GitHub Advisory). Multiple Nuclei templates have been committed to the ProjectDiscovery nuclei-templates repository, enabling automated scanning for vulnerable instances. The vulnerability is not listed in the CISA KEV catalog and no threat actor attribution has been reported.

1. Reconnaissance: Use tools like WPScan, Shodan, or Censys to identify WordPress sites running the Widgets for Social Photo Feed plugin (versions ≤ 1.8), or use the available Nuclei template to scan at scale.
2. Identify vulnerable endpoints: Confirm the REST API endpoints /wp-json/trustindex_feed_hook_instagram/troubleshooting and /wp-json/trustindex_feed_hook_instagram/submit-data are accessible without authentication by sending unauthenticated GET/POST requests.
3. Access plugin data: Send an unauthenticated HTTP GET request to the /troubleshooting endpoint to retrieve plugin configuration and diagnostic data.
4. Modify plugin settings: Send an unauthenticated HTTP POST request to the /submit-data endpoint with a crafted JSON payload to overwrite plugin settings, such as altering Instagram feed configurations or disrupting plugin functionality.
5. Achieve objective: Leverage modified settings to degrade site functionality, redirect social feed content, or gather configuration details for further reconnaissance (GitHub Advisory, Wordfence).

• Network: Unauthenticated HTTP GET/POST requests to /wp-json/trustindex_feed_hook_instagram/troubleshooting or /wp-json/trustindex_feed_hook_instagram/submit-data from external or unexpected IP addresses.
• Logs: WordPress access logs showing repeated requests to the above REST API endpoints without authentication headers or session cookies; unusual 200 OK responses to these endpoints from unknown sources.
• File System / Database: Unexpected changes to plugin settings stored in the WordPress wp_options table related to the social-photo-feed-widget plugin entries.
• Process/Behavior: Sudden changes in Instagram feed display behavior on the WordPress site, such as feeds showing unexpected content or becoming non-functional, which may indicate settings have been tampered with.

WordPress site administrators should immediately update the Widgets for Social Photo Feed plugin to a version newer than 1.8, which includes the fix adding proper capability checks to the affected REST API endpoints (GitHub Advisory, Plugin Changeset). If an immediate update is not possible, consider temporarily deactivating the plugin or using a web application firewall (WAF) rule to block unauthenticated requests to the /wp-json/trustindex_feed_hook_instagram/ REST API namespace. Verify all WordPress installations running this plugin are updated and audit plugin settings for unauthorized changes.

Wordfence reported the vulnerability as part of their weekly WordPress vulnerability report for the week of April 27–May 3, 2026, noting it as a missing capability check issue (Wordfence Blog). The vulnerability was also referenced in a CISA vulnerability bulletin for the week of April 27, 2026 (CISA Bulletin). Community reaction has been limited given the medium severity rating and lack of active exploitation.