The SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that forwards requests directly to the Instagram Graph API without validating the origin of the request. Parameters such as an access token, container ID, and Instagram account ID are accepted from untrusted users and passed to InstagramUploader::publishMediaIfIsReady(). This enables any internet user to trick the server into making arbitrary Graph API calls, potentially using stolen tokens or the platform’s own credentials. The result can be unwanted posts, data exfiltration, or abuse of the account’s messaging capabilities, reflecting a missing authentication flaw identified by CWE‑862.

WWBN AVideo, versions 26.0 and earlier, have the vulnerable endpoint. Versions newer than 26.0 are presumed to have the vulnerability remedied.

The CVSS score of 5.3 denotes moderate severity. Because the endpoint accepts requests without authentication, an attacker only needs to issue a simple HTTP call to publishInstagram.json.php to exploit the flaw. The EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not yet been documented, yet the low barrier to entry poses a real threat to systems that rely on this plugin.