{
 "id": "WPSEC-2026-2969",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2969/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2969/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2969/index.md",
 "title": "Social Feed Gallery <= 5.0.13 - Missing Authorization to Unauthenticated Arbitrary Instagram Source Queries via Frontend REST Endpoints",
 "description": "The Social Feed Gallery plugin for WordPress is vulnerable to unauthorized access via the public frontend REST endpoints (user-media, hashtag-media, tagged-media and user-stories) in all versions up to, and including, 5.0.13, due to an insufficient permission check that only verified that the requested account was used in some feed, not that the requested source and hashtag belonged to a feed the site renders. This makes it possible for unauthenticated attackers to use a connected account's stored Instagram access token to query arbitrary hashtags, tagged media and stories that the site never chose to display, and to use up the account's limit of 30 unique hashtag searches per 7 days, which breaks the site's legitimate hashtag feeds.",
 "plugin": {
  "slug": "insta-gallery",
  "name": "Social Feed Gallery",
  "full_name": "Social Feed Gallery",
  "wordpress_org": "https://wordpress.org/plugins/insta-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/insta-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/insta-gallery"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.0.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.0.14"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.0.14",
 "remediation": "Update to 5.0.14 or later.",
 "fix_released": "2026-11-10T15:28:33+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:14:07.628703+00:00",
 "also_published_as": {
  "source": "wpvulnerability",
  "cve": [
   "CVE-2026-114705"
  ],
  "published": "2026-10-24T00:00:00+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2969/",
  "https://plugins.svn.wordpress.org/insta-gallery/tags/5.0.14/",
  "https://wordpress.org/plugins/insta-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/insta-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}