Social Photo Feed CVE-2026-39787

Exploitation requires only that the target WordPress site has the 10Web Social Photo Feed plugin installed and active at version 1.4.35 or earlier; per CVSS PR:N/UI:N it needs no authentication and no user interaction, and per AV:N/AC:L it is remotely reachable with low complexity against default installations. The primary limiting factors are that the site must run this specific plugin at a vulnerable version, and the impact is bounded to Low confidentiality and Low integrity (no availability/full-compromise impact), meaning the attacker gains unauthorized access to plugin-controlled data or actions rather than complete site control. The exact vulnerable endpoint/feature is not named in the provided description.

This is a medium-severity (CVSS 6.5) broken access control / missing authorization flaw (CWE-862) in the 10Web Social Photo Feed WordPress plugin (versions <= 1.4.35), reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, but only partial confidentiality and integrity impact and no availability impact - consistent with an attacker invoking plugin functionality or reading/writing data they should not have access to, rather than full site takeover. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so there is no signal of active exploitation or published exploit code; this appears to be a Patchstack-researched disclosure rather than an in-the-wild threat. The practical risk is moderate: easy to exploit once a public exploit exists and affects any site running the vulnerable plugin, but the limited (Low) impact scope means it is a patch-when-convenient item rather than an emergency, absent any KEV or EPSS escalation signal. Key missing data: no EPSS, no KEV, no POC status, and no explicit fixed version in the provided references - only an upper-bound affected range (<= 1.4.35).

An unauthenticated remote attacker sends crafted HTTP requests to an exposed plugin endpoint (e.g., an AJAX or REST action lacking a capability/authorization check) on a WordPress site running 10Web Social Photo Feed <= 1.4.35. Because the endpoint does not verify authorization, the attacker can access or modify plugin-controlled data or settings they should not be able to reach. No public exploit code was identified in the provided data, but the low attack complexity and lack of authentication make exploitation straightforward once request details are known.