Social Photo Feed EUVD-2026-112998

Requires an authenticated account with at least Contributor-level privileges on a WordPress site running 10Web Social Photo Feed (wd-instagram-feed) version 1.5.6 or earlier (PR:L per the CVSS vector and the 'Contributor' scope in the title). No user interaction is needed (UI:N) and the vector is network-reachable (AV:N). Exploitation is therefore limited to environments that grant Contributor accounts to untrusted or lower-trust users; sites that do not allow such registrations or restrict those roles are far less exposed. The exact plugin input/feature that deserializes untrusted data is not described in the available sources, and successful object injection generally also depends on a usable gadget chain being present.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity flaw with high impact to confidentiality, integrity and availability - consistent with a PHP Object Injection (CWE-502) that can escalate to code execution or data compromise via a suitable gadget chain. The decisive mitigating signal is PR:L: the CVE title explicitly scopes this to 'Contributor' level, so an attacker needs a valid authenticated Contributor account on the target WordPress site, not anonymous access. The vuln.today decision label is 'this_week' (not act_now/emergency), which matches a serious authenticated flaw without confirmed mass exploitation. No EPSS score was supplied, no CISA KEV listing is present, and no proof-of-concept or exploit code is indicated - only a Patchstack advisory reference. The main data gap is mechanism: the CVE description does not say which parameter or feature deserializes untrusted input, and no gadget chain is documented, so whether object injection reliably reaches RCE on a default install is unverified. Treat as an authenticated high-severity issue to patch promptly on any site that grants untrusted users Contributor accounts.

An attacker who holds (or registers/obtains) a Contributor-level account on a WordPress site running 10Web Social Photo Feed <= 1.5.6 submits a crafted serialized PHP object through an affected plugin input. If a suitable gadget chain is present in the plugin or other installed code, deserialization instantiates attacker-controlled objects, potentially leading to arbitrary code execution or data compromise. No public exploit code is identified at time of analysis; the trigger parameter is not described in the available sources.