CVE-2025-14726 is a vulnerability in the Widgets for Social Photo Feed WordPress plugin that arises from missing capability checks on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints. This flaw permits unauthenticated attackers to access and update plugin settings, potentially exposing sensitive information and allowing unauthorized modifications. The issue affects all versions up to 1.8. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector and no privileges or user interaction required. No official remediation or patch has been disclosed by the vendor as of the published date.

An attacker can remotely access and modify plugin settings without authentication, potentially leading to unauthorized disclosure of sensitive information and unauthorized changes to plugin configuration. This could affect the integrity and confidentiality of the plugin's data. There are no reports of active exploitation in the wild. The vulnerability does not require user interaction or privileges, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected REST API endpoints through web application firewall rules or other access controls to prevent unauthenticated access. Monitor for updates from the vendor and apply patches promptly once available.