The Social Feed Gallery plugin for WordPress has a missing authorization check in its REST API that allows unauthenticated users to retrieve Instagram profile and media data for any Instagram account connected by the site owner. This results in a moderate-information exposure where private content can be exfiltrated without needing credentials, causing a breach of confidentiality. The weakness is identified as a missing authorization control (CWE-862).

vulnerable versions of the quadlayers Social Feed Gallery plugin up to and including 4.9.2. Any WordPress site that has installed and activated the plugin and has connected an Instagram account is at risk. The plugin’s REST endpoint /user-profile is the entry point for the exploit.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of < 1% shows a very low probability of exploitation observed in the wild, and the vulnerability is not listed in the CISA KEV catalogue. Attackers can exploit the issue by sending unauthenticated GET requests to the plugin’s REST endpoint, which returns sensitive Instagram data. Since no authentication is enforced, the attack surface is public and requires only knowledge of the correct URL.