CVE-2025-14726 is a vulnerability in the Widgets for Social Photo Feed WordPress plugin where the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints lack proper capability checks. This allows unauthenticated attackers to read and modify plugin settings, exposing sensitive information and potentially impacting plugin integrity. The issue affects all plugin versions up to 1.8. The CVSS 3.1 base score is 6.5, indicating medium severity. No official fix or patch has been published, and no known exploits have been reported.

An unauthenticated attacker can access and modify plugin settings through vulnerable REST API endpoints, leading to unauthorized exposure of sensitive information and potential alteration of plugin behavior. This could affect the confidentiality and integrity of the plugin's data and configuration. There is no indication of availability impact beyond the plugin itself. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable REST API endpoints through web application firewall rules or other access controls to prevent unauthenticated access. Monitor for updates from the vendor regarding patches or official mitigations.