CVE-2025-68595
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.
Analysis
Broken access control in Trustindex Widgets for Social Photo Feed (WordPress plugin) through version 1.8 allows authenticated attackers with low privileges to bypass authorization controls and execute high-impact actions. The vulnerability has low attack complexity (CVSS:3.1 AV:N/AC:L/PR:L) enabling compromise of confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) indicates relatively low observed exploitation probability, and no public exploit or CISA KEV listing exists at time of analysis, suggesting this remains a patch-priority issue rather than an active threat.
Technical Context
This vulnerability stems from CWE-862 (Missing Authorization), a common access control weakness in web applications where security checks are absent or improperly implemented on privileged functions. The WordPress plugin 'Widgets for Social Photo Feed' by Trustindex fails to validate whether authenticated users have appropriate permissions before granting access to sensitive operations. In WordPress plugin architecture, this typically manifests when admin-level or privileged API endpoints lack capability checks (such as current_user_can() validation), allowing any authenticated user-regardless of role-to invoke restricted functionality. The plugin integrates social media photo feeds into WordPress sites, and missing authorization on widget configuration, data modification, or administrative functions could allow subscriber-level users to manipulate settings, access sensitive data, or alter site content beyond their intended scope. This is a persistent authorization flaw affecting the core plugin logic rather than a configuration issue.
Affected Products
The vulnerability affects Trustindex Widgets for Social Photo Feed, a WordPress plugin identified by the slug 'social-photo-feed-widget'. All versions from the earliest release through version 1.8 are vulnerable to the missing authorization flaw. The vendor is Trustindex, and the product is distributed through the official WordPress.org plugin repository. WordPress site administrators running any version at or below 1.8 of this plugin should consider their installations affected, particularly environments where untrusted users have authenticated access at any privilege level (subscriber, contributor, author roles). The Patchstack advisory available at https://patchstack.com/database/Wordpress/Plugin/social-photo-feed-widget/vulnerability/wordpress-widgets-for-social-photo-feed-plugin-1-7-7-broken-access-control-vulnerability?_s_id=cve provides additional context, though the exact fixed version is not specified in the available data.
Remediation
WordPress administrators should immediately check their installed version of Widgets for Social Photo Feed and upgrade to the latest available version from the official WordPress plugin repository or the vendor's update channel. While the provided data confirms versions through 1.8 are affected, a specific patched release version is not independently confirmed from available intelligence. Administrators should consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/social-photo-feed-widget/vulnerability/wordpress-widgets-for-social-photo-feed-plugin-1-7-7-broken-access-control-vulnerability?_s_id=cve and the plugin's official changelog for the remediated version. As an interim mitigation, restrict authenticated user registration to trusted individuals only, review existing user accounts for suspicious low-privilege accounts, enable WordPress audit logging to detect unauthorized access attempts to administrative functions, and consider temporarily disabling the plugin if not essential to operations until a confirmed patch is applied. Implement principle of least privilege by limiting subscriber and contributor role assignments. Monitor WordPress admin activity logs for anomalous behavior from low-privileged accounts accessing widget configuration or related administrative areas.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today