CVE-2025-14726: WordPress Social Photo Feed Auth Bypass

CVE-2025-14726 Overview

CVE-2025-14726 affects the Widgets for Social Photo Feed plugin for WordPress in all versions up to and including 1.8. The plugin exposes two REST API endpoints, /trustindex_feed_hook_instagram/troubleshooting and /trustindex_feed_hook_instagram/submit-data, without proper capability checks. Unauthenticated attackers can read plugin configuration data and modify plugin settings over the network. The vulnerability is classified under [CWE-200] (Information Exposure) and stems from broken access control on REST routes.

Critical Impact
Unauthenticated remote attackers can read and modify plugin settings on any WordPress site running version 1.8 or earlier of Widgets for Social Photo Feed.

Affected Products

Widgets for Social Photo Feed plugin for WordPress (slug: social-photo-feed-widget)
All versions up to and including 1.8
WordPress sites with the plugin installed and activated

Discovery Timeline

2026-05-02 - CVE-2025-14726 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2025-14726

Vulnerability Analysis

The plugin registers two WordPress REST API routes that perform privileged operations without verifying the caller's capabilities. The /trustindex_feed_hook_instagram/troubleshooting endpoint exposes diagnostic and configuration information. The /trustindex_feed_hook_instagram/submit-data endpoint accepts and stores plugin settings.

WordPress requires developers to supply a permission_callback when registering routes through register_rest_route(). When that callback is missing, returns true, or fails to call current_user_can(), the route becomes accessible to any anonymous client. In this plugin, the permission_callback does not enforce an administrative capability such as manage_options, so REST clients without authentication can invoke both endpoints.

The attack vector is network-based and requires no user interaction or authentication. Confidentiality impact is limited because the leaked data is plugin settings rather than user secrets, and integrity impact is similarly scoped to plugin configuration.

Root Cause

The root cause is a missing capability check on REST API routes. The plugin's route registration does not gate access on user role or capability, treating administrative actions as public endpoints. This is a classic broken access control pattern in WordPress plugins.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable WordPress site at /wp-json/trustindex_feed_hook_instagram/troubleshooting to retrieve plugin state, or to /wp-json/trustindex_feed_hook_instagram/submit-data with a JSON body to overwrite plugin settings. No cookies, nonces, or API keys are validated before the handler executes.

The vulnerability mechanism is described in prose only because no public proof-of-concept code has been verified. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-14726

Indicators of Compromise

Unauthenticated HTTP requests to /wp-json/trustindex_feed_hook_instagram/troubleshooting in web server access logs
POST or PUT requests to /wp-json/trustindex_feed_hook_instagram/submit-data from unknown source IPs
Unexpected changes in the wp_options table for keys belonging to the Widgets for Social Photo Feed plugin
Requests to these endpoints lacking a valid WordPress authentication cookie or nonce header

Detection Strategies

Review WordPress and reverse-proxy logs for REST API calls to trustindex_feed_hook_instagram routes from non-administrator sessions
Compare current plugin settings against a known-good baseline to identify unauthorized modifications
Run a plugin inventory across all WordPress sites to find installations of social-photo-feed-widget at version 1.8 or below

Monitoring Recommendations

Enable WordPress audit logging to record REST API calls and option changes
Forward web server access logs to a centralized log analytics platform and alert on anonymous access to /wp-json/trustindex_feed_hook_instagram/*
Track plugin version drift through automated WordPress site management tooling

How to Mitigate CVE-2025-14726

Immediate Actions Required

Update the Widgets for Social Photo Feed plugin to a version newer than 1.8 as soon as the vendor releases a fixed build
If no fixed version is available, deactivate and remove the plugin until a patch is published
Audit plugin settings stored in wp_options and revert any unauthorized changes

Patch Information

The vendor committed a fix in WordPress.org plugin repository changeset 3513612. Review the WordPress Changeset Update for the exact code change adding capability validation to the affected REST routes. Install the patched version through the WordPress plugin updater on every affected site.

Workarounds

Block external access to /wp-json/trustindex_feed_hook_instagram/troubleshooting and /wp-json/trustindex_feed_hook_instagram/submit-data at the web application firewall or reverse proxy
Restrict the WordPress REST API to authenticated users using a hardening plugin or custom rest_authentication_errors filter
Limit administrative endpoints to known IP ranges until the plugin is updated

bash

# Example NGINX rule to block the vulnerable endpoints
location ~* ^/wp-json/trustindex_feed_hook_instagram/(troubleshooting|submit-data) {
    deny all;
    return 403;
}