The WPZOOM Social Feed Widget & Block plugin for WordPress suffers from a missing capability check in the wpzoom_instagram_clear_data() function in all versions up to 2.1.13. This authorization bypass vulnerability (CWE-862) enables any authenticated user with subscriber-level privileges or higher to invoke this function and delete all Instagram images integrated into the site. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and limited availability impact.

An attacker with subscriber-level or higher access can delete all Instagram images displayed by the plugin on the affected WordPress site, causing denial of availability of that content. There is no impact on confidentiality or integrity of data. The disruption is limited to the availability of Instagram images managed by the plugin.

No official patch or remediation guidance is currently available from the vendor. Since this vulnerability requires authenticated access at subscriber level or above, site administrators should review user roles and restrict subscriber privileges if possible. Monitor vendor channels for updates or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.