Technical impact
The WP Social Feed Gallery plugin (insta‑gallery) contains a missing‑authorization flaw that allows any authenticated user to bypass normal access checks and interact with restricted administrative controls. By reaching the plugin’s web endpoints, an attacker can read or modify settings, media feeds, and potentially other sensitive data that should only be accessible to privileged users. This weakness aligns with CWE‑862, a standard missing‑authorization vulnerability.
Affected Systems
All WordPress installations using the WP Social Feed Gallery plugin from quadlayers, version five point zero thirteen or earlier, are impacted. No other versions or products are explicitly listed as affected in the advisory.
Risk and Exploitability
The CVSS score of 6.5 marks this as a moderate‑severity issue; the EPSS score is not available, so the exact exploitation probability is unknown. It is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no widely reported exploits. The attack vector is likely the web interface, where a remote actor with any authenticated session can reach the vulnerable endpoints and exploit the missing access control without needing elevated credentials. Administrators should still prioritize remediation due to the potential for privilege escalation and data disclosure.
