Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

WP Social Feed Gallery plugin may reveal private Instagram feeds

CVE-2026-114705 · published 11 days ago
Summary

The WP Social Feed Gallery plugin (versions up to 5.0.13) does not properly check who is allowed to see the Instagram gallery content. Because of this, anyone who discovers the website’s URL can view the feed, even if it was meant to be private. Update to the latest version or remove the plugin until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
quadlayers wp social feed gallery <= 5.0.13
Original advisory text
WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published24 Oct 2026
Updated4 Nov 2026
First seen24 Oct 2026
Sources
CVE-2026-114705 · NVD
CVE-2026-114705 · MITRE
Track software like this
Free during beta