What is the CVSS score of CVE-2025-14726?

CVE-2025-14726 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2025-14726?

Yes, a public proof-of-concept exploit is available for CVE-2025-14726. Prioritise patching immediately. EPSS: 0.0%.

Widgets for Social Photo Feed CVE-2025-14726

EUVD-2025-209610 MEDIUM

Information Exposure (CWE-200)

2026-05-02 security@wordfence.com

WordPress Authentication Bypass Information Disclosure

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 05:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 05:22 euvd

EUVD-2025-209610

Analysis Generated

May 02, 2026 - 05:22 vuln.today

CVE Published

May 02, 2026 - 05:16 nvd

MEDIUM 6.5

DescriptionCVE.org

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.

AnalysisAI

Unauthenticated attackers can access and modify plugin settings in the Widgets for Social Photo Feed WordPress plugin through missing capability checks on two REST API endpoints, allowing unauthorized data access and configuration changes in all versions up to and including 1.8. The vulnerability requires only network access with no user interaction, making it trivially exploitable by remote attackers without authentication credentials.

Technical ContextAI

The vulnerability stems from inadequate authorization controls on REST API endpoints registered by the WordPress plugin. Two specific endpoints-'/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data'-fail to implement WordPress capability checks (typically checking for 'manage_options' or similar administrative permissions) before processing requests. WordPress REST API endpoints should validate user roles and capabilities before exposing sensitive operations; this plugin implements the endpoints but omits the authorization layer. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes the class of failure where the application exposes functionality without proper access control, allowing unauthenticated principals to interact with protected resources.

RemediationAI

Upgrade to a patched version released after version 1.8. According to the Wordfence advisory and WordPress plugin repository changeset 3513612, a fix addressing the missing capability checks has been committed. Site administrators should update the Widgets for Social Photo Feed plugin to the latest available version through the WordPress admin panel (Plugins > Installed Plugins > Update). If an immediate patch is unavailable, temporarily disable the plugin and remove it from active use until a fixed version is released. For environments where the plugin must remain active, implement WordPress REST API restrictions at the web server or firewall level to block external access to the '/trustindex_feed_hook_instagram/' endpoint prefix, though this may affect legitimate functionality and should only be used as a temporary bridge until patching is complete.