CVE-2025-10637
BaseFortify
Publication date: 2025-10-25
Last updated on: 2025-10-27
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | social_feed_gallery | 4.9.3 |
| wordpress | social_feed_gallery | 4.9.2 |
| wordpress | insta_gallery | 4.9.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Social Feed Gallery WordPress plugin (versions <= 4.9.2) is an information exposure issue caused by improper authorization checks. Specifically, the plugin's frontend REST API endpoints do not properly verify if a user is authorized to perform certain actions. This flaw allows unauthenticated attackers to access and exfiltrate Instagram profile and media data from any Instagram account that the site owner has connected to their WordPress site. [2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized individuals to access Instagram profile and media data linked to your WordPress site without your permission. This could lead to privacy breaches, unauthorized data disclosure, and potential misuse of your Instagram content. Since the attacker does not need to be authenticated, it increases the risk of data exposure to any internet user. [2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could negatively affect compliance with data protection regulations such as GDPR and HIPAA because it allows unauthorized access to personal data (Instagram profile and media information). Exposure of such data without proper authorization or consent may constitute a violation of privacy and data protection requirements mandated by these standards, potentially leading to legal and regulatory consequences. [3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the Social Feed Gallery plugin version installed on your WordPress site is less than or equal to 4.9.2. Additionally, monitoring REST API requests to the endpoint related to user profiles (e.g., frontend/user-profile) for unauthorized access attempts could indicate exploitation attempts. Since the vulnerability involves unauthorized access to Instagram profile and media data via the plugin's REST API, you can inspect HTTP GET requests to the plugin's REST API endpoints. For example, using curl to test access without authentication: curl -X GET 'https://yourwordpresssite.com/wp-json/insta-gallery/frontend/user-profile?account_id=1' If this returns Instagram profile data without authentication, the site is vulnerable. Also, scanning the installed plugin version via WP-CLI can help: wp plugin get social-feed-gallery --field=version [2, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Social Feed Gallery plugin to version 4.9.3 or later, where the authorization vulnerability in the frontend REST API endpoints has been fixed. If updating immediately is not possible, restrict access to the REST API endpoints related to the plugin by implementing access controls such as IP whitelisting or authentication requirements. Additionally, monitor your site for suspicious REST API requests and consider temporarily disabling the plugin until the update can be applied. [3]