The Widgets for Social Photo Feed plugin contains a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all releases up to and including version 1.8. This flaw permits any unauthenticated user to retrieve and alter the plugin’s configuration settings. The weakness is classified as a privacy and integrity issue (CWE‑200).

All WordPress sites that have installed trustindex Widgets for Social Photo Feed version 1.8 or earlier are affected, regardless of other security posture or additional hardening. The vulnerability is tied directly to the plugin’s REST endpoints and does not rely on other components of WordPress.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. The EPSS score is not provided, leaving the current exploitation probability uncertain, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending unauthenticated HTTP requests to the exposed REST API endpoints; no special privileges or conditions are required, and no manual configuration is needed to trigger the exploit.