WordPress Widgets for Social Photo Feed is a popular plugin used by WordPress users to integrate social media photo feeds into their websites. It is widely adopted by bloggers, small businesses, and social media influencers who aim to enhance their websites' visual appeal with dynamic content. The plugin enhances user engagement by displaying up-to-date photos from social media accounts. It is typically managed by site administrators or webmasters who have the responsibility of maintaining and updating plugins for optimal performance. Due to its popularity, maintaining its security is vital to protect the overall integrity of the websites using it. Consequently, regular updates and security checks are necessary to avert potential vulnerabilities.
Information Disclosure vulnerabilities occur when an application unintentionally reveals sensitive information to unauthorized users. In the context of the WordPress Widgets for Social Photo Feed plugin, this vulnerability arises from missing capability checks on certain REST API endpoints. As a result, unauthenticated attackers can access and modify plugin settings without proper authorization, potentially leading to data exposure or modification. Such vulnerabilities pose a significant security risk as they allow exploitation of application features that should be restricted by design. The threat becomes more pressing when plugin settings that influence site behavior and aesthetics are accessible.
The Widgets for Social Photo Feed WordPress plugin up to version 1.8 has a vulnerability in its REST API endpoints due to missing capability checks. These endpoints allow unauthenticated attackers to access sensitive plugin information and modify settings remotely. The vulnerable parameters or endpoints reside within '/wp-json/trustindex_feed_hook_instagram/'. Specific endpoints like 'troubleshooting' and 'get-token' expose information such as WP version, PHP info, MySQL version, and active plugins to unauthorized users. This vulnerability stems from inadequate input validation and access control settings on these API endpoints.
The exploitation of this vulnerability may lead to the unauthorized modification of a WordPress site's layout and functionality. Attackers might alter plugin settings to disrupt the site's appearance or functionality. Additionally, access to sensitive system information can facilitate more targeted and damaging follow-up attacks. In the worst-case scenario, critical information disclosed through these endpoints could be used to exploit other vulnerabilities within the WordPress ecosystem.
REFERENCES
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/social-photo-feed-widget/widgets-for-social-photo-feed-18-missing-authentication-to-unauthenticated-plugin-settings-accessupdate-via-trustindex-feed-hook-instagram-rest-api-endpoints
- https://wordpress.org/plugins/social-photo-feed-widget/
- https://nvd.nist.gov/vuln/detail/CVE-2025-14726
- Update the WordPress Widgets for Social Photo Feed plugin to a version beyond 1.8.
- Implement rigorous capability checks on all API endpoints to ensure unauthorized users cannot access them.
- Regularly audit the security settings of registered plugins to check for misconfigurations.
- Monitor your website's plugins and API endpoints for suspicious activities.
- Educate site administrators about the importance of access control and proper permissions management.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →