WP Social Feed Gallery CVE-2026-114705

Exploitation requires only that a target WordPress site run the WP Social Feed Gallery (insta-gallery) plugin at a version from n/a through 5.0.13; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed, so default installations of an affected version are reachable remotely. The available sources do not name the exact plugin feature, endpoint, or configuration setting whose authorization check is missing, so the precise trigger is not described. The primary limiting factor is impact scope: the flaw is rated only Low confidentiality and Low integrity with no availability impact (S:U), so it does not by itself yield full site takeover, code execution, or data destruction.

This is a moderate-severity, likely-low-urgency issue rather than a top-tier emergency. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, meaning network-reachable, low-complexity, unauthenticated (PR:N) access with only low confidentiality and low integrity impact and no availability impact - consistent with a CWE-862 Missing Authorization flaw where an access-control check is absent on a plugin endpoint. The vuln.today decision label is 'this_month', which signals scheduled remediation, not act_now/emergency. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact values were supplied, so exploitation probability cannot be quantified from the input; absence of these signals is not evidence of safety but does mean there is no data indicating active or imminent widespread exploitation. The only reference is the Patchstack database entry (the reporter), which is a vulnerability advisory, not verified working exploit code. Net: a genuine but limited broken-access-control issue worth patching on a normal monthly cycle; the PR:N vector is the main aggravating factor, while the capped Low/Low impact and lack of exploitation signals keep real-world risk measured.

A remote, unauthenticated attacker sends a request directly to an insta-gallery plugin endpoint that fails to verify the caller's authorization, allowing them to read or modify plugin-controlled data they should not be able to reach. The exact triggering endpoint and the specific data exposed are not described in the available sources. No public exploit identified at time of analysis.