CVE-2025-10637: Social Feed Gallery Information Disclosure

CVE-2025-10637 Overview

CVE-2025-10637 affects the Social Feed Gallery (also known as insta-gallery) plugin for WordPress in versions up to and including 4.9.2. The plugin fails to verify authorization on a REST API endpoint that returns Instagram profile and media data. Unauthenticated attackers can query this endpoint to exfiltrate Instagram profile and media content for any account the site owner connected to their site. The flaw is classified under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated remote attackers can retrieve Instagram profile and media data linked to affected WordPress sites without any user interaction or privileges.

Affected Products

Social Feed Gallery (insta-gallery) WordPress plugin versions <= 4.9.2
WordPress sites with Instagram accounts connected through the plugin
Vulnerable file: lib/api/rest/endpoints/frontend/class-user-profile.php

Discovery Timeline

2025-10-25 - CVE-2025-10637 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10637

Vulnerability Analysis

The Social Feed Gallery plugin exposes a REST API endpoint through class-user-profile.php that returns Instagram profile and media information. The endpoint does not enforce a capability check or authorization callback, so any unauthenticated HTTP client can invoke it. The vulnerability falls into the Information Exposure category and is a straightforward Broken Access Control issue on a public REST route.

An attacker sending a crafted GET request to the plugin's REST route receives Instagram content associated with the connected account. The impact is limited to confidentiality of the connected Instagram data — integrity and availability are not affected. The EPSS score at the time of writing indicates low observed exploitation activity, but exploitation is trivial because no authentication is required.

Root Cause

The root cause is a missing permission_callback (or equivalent capability check) on the WordPress REST API route registered by the plugin. WordPress REST endpoints must return true from a permission callback only when the caller is authorized. The vulnerable endpoint effectively grants public access to data that should require authentication or a nonce, matching the [CWE-862] pattern of missing authorization on a sensitive operation.

Attack Vector

The attack is delivered over the network via HTTP requests to the WordPress REST API. No credentials, user interaction, or elevated privileges are required. An attacker identifies a WordPress site running Social Feed Gallery <= 4.9.2, then issues an unauthenticated request to the plugin's user profile REST endpoint. The server responds with Instagram profile metadata and media items belonging to the account the site owner connected.

The vulnerability is exploited entirely through legitimate REST API request patterns, so it produces normal-looking HTTP traffic without triggering web-application firewalls that rely on payload signatures. For technical detail on the fix, see the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-10637

Indicators of Compromise

Unauthenticated HTTP GET requests to REST routes containing insta-gallery or instagram/user-profile paths
Repeated requests to /wp-json/ endpoints registered by the Social Feed Gallery plugin from external IP addresses
Anomalous outbound scraping traffic patterns targeting multiple WordPress sites with the plugin installed

Detection Strategies

Inventory installed WordPress plugins and flag any site running Social Feed Gallery at version 4.9.2 or earlier
Review web server access logs for unauthenticated requests to plugin REST endpoints returning HTTP 200 responses with JSON payloads
Alert on high-volume GET requests to /wp-json/ paths from a single source IP or user agent

Monitoring Recommendations

Enable REST API request logging on WordPress hosts and forward logs to a central SIEM for correlation
Track plugin version drift across managed WordPress fleets and alert when vulnerable versions are detected
Monitor for scraping-style behavior such as sequential enumeration of REST endpoints without a valid session cookie

How to Mitigate CVE-2025-10637

Immediate Actions Required

Update the Social Feed Gallery plugin to a version newer than 4.9.2 on all WordPress installations
If an immediate update is not possible, deactivate the plugin until it can be patched
Audit the connected Instagram accounts and rotate any credentials or access tokens stored by the plugin

Patch Information

The vendor addressed CVE-2025-10637 in a release after 4.9.2. The fix is visible in the plugin's public source control as changeset 3381423, which modifies lib/api/rest/endpoints/frontend/class-user-profile.php to add proper authorization enforcement. Review the WordPress Plugin Changeset and download the latest release from the WordPress plugin directory.

Workarounds

Block unauthenticated access to the plugin's REST endpoints at the web application firewall or reverse proxy layer
Restrict /wp-json/insta-gallery/ routes to authenticated sessions using server-side access rules
Remove or disable the plugin entirely if Instagram gallery functionality is not required

bash

# Example nginx rule to block unauthenticated access to the vulnerable REST route
location ~* /wp-json/insta-gallery/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}