Social Feed Gallery <= 5.0.13 - Missing Authorization to Unauthenticated Arbitrary Instagram Source Queries via Frontend REST Endpoints
- ID
- WPSEC-2026-2969
- Plugin
- Social Feed Gallery (insta-gallery)
- Affected
- all versions before 5.0.14
- Remediation
- Update to 5.0.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Social Feed Gallery on WPSec AttackSurface
- Fix released
- Published
Also published later by Wpvulnerability as CVE-2026-114705, on 2026-10-24.
Description
The Social Feed Gallery plugin for WordPress is vulnerable to unauthorized access via the public frontend REST endpoints (user-media, hashtag-media, tagged-media and user-stories) in all versions up to, and including, 5.0.13, due to an insufficient permission check that only verified that the requested account was used in some feed, not that the requested source and hashtag belonged to a feed the site renders. This makes it possible for unauthenticated attackers to use a connected account's stored Instagram access token to query arbitrary hashtags, tagged media and stories that the site never chose to display, and to use up the account's limit of 30 unique hashtag searches per 7 days, which breaks the site's legitimate hashtag feeds.
References
- https://wpsec.com/vuln/WPSEC-2026-2969/
- https://plugins.svn.wordpress.org/insta-gallery/tags/5.0.14/
- https://wordpress.org/plugins/insta-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS