CVE-2026-114705VulnerabilityPublished 10/24/2026

CVE-2026-114705: Missing Authorization in quadlayers WP Social Feed Gallery

Affects quadlayers WP Social Feed GallerySource CVE Database V5

CVSS 3.1 base score

6.5Medium

Exploitation: Not in CISA KEV, no exploitation reported

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What to do

AI-suggested

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the plugin's functionalities and monitor for any unusual activity related to this plugin.

Affected software

Product	Affected	Fixed in
quadlayersWP Social Feed Gallery	Affected >=0 <=5.0.13	Fixed in–

Description

CVE-2026-114705 is a missing authorization vulnerability in the quadlayers WP Social Feed Gallery plugin, versions up to 5.0.13. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating with a CVSS score of 6.5.

Summary

The vulnerability identified as CVE-2026-114705 affects the WP Social Feed Gallery plugin by quadlayers. It is caused by missing authorization checks, which means that access control security levels are incorrectly configured. This allows unauthorized remote attackers to access or manipulate certain functionalities or data without proper permissions. The affected versions include all releases from initial versions up to and including 5.0.13. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

Impact

Exploitation of this vulnerability could lead to unauthorized access to or modification of data within the WP Social Feed Gallery plugin environment. The impact is limited to confidentiality and integrity, with no reported impact on availability. There are no known exploits in the wild at this time.

References

patchstack.com/database/wordpress/plugin/insta-gallery/vulnerability/wordpress-wp-social-feed-gallery-plugin-5-0-13-broken-access-control-vulnerability?_s_id=cve (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 10/24/2026, 10:11:49 UTC

Technical details

References

Related threats