CVE-2025-10637

Vulnerability

Overview The Social Feed Gallery plugin for WordPress, versions 4.9.2 and earlier, contains an information exposure vulnerability due to insufficient authorization checks. The plugin fails to properly verify that a user is authorized to perform certain actions, allowing unauthenticated attackers to access sensitive data [1].

Exploitation

Conditions An unauthenticated attacker can exploit this by sending crafted requests to the plugin's endpoints that should require authentication. No special privileges or prior access to the WordPress installation is needed, as the issue stems from missing permission checks on actions that expose private data connected to the site [1].

Impact

Successful exploitation enables the attacker to exfiltrate Instagram profile information and media data from any account that the site owner connected to their website. This includes potentially private photos and metadata that the site owner intended to display only to their audience, leading to unauthorized disclosure of content [1].

Mitigation

The vendor has not yet released a patched version beyond 4.9.2 as of this writing. Users are advised to monitor the plugin's update channel or consider disabling the plugin until a security update is available. The issue is documented and publicly known [1].