The vulnerability is a missing authorization flaw that permits users to manipulate the plugin’s configuration and access its social photo feed data without proper privileges. This flaw is exposed through the plugin’s administrative interfaces, allowing an attacker who can reach these pages to change settings, view content, or execute privileged actions that normally require higher-level roles. The weakness is identified as CWE‑862, indicating an authorization bypass.

The affected product is the Trustindex Widgets for Social Photo Feed WordPress plugin, version 1.8 or earlier. All installations of this plugin under that version range are susceptible.

With a CVSS score of 5.3 the flaw is considered moderate; the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that the attack vector is through web‑accessible plugin endpoints, likely requiring access to the WordPress dashboard or the plugin’s public URLs. No additional conditions such as local user privileges are stated, so the flaw may be exploitable by any user who can interact with the plugin’s interfaces.