Live › vulnerability › CVE-2026-114705
Go to dashboardWP Social Feed Gallery (insta-gallery), a WordPress plugin by quadlayers, has a missing authorization check, so requests can reach functions that should be restricted. An attacker with access to the plugin's endpoints can perform actions their role should not allow.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 10:47 UTC. All times on this page are UTC.
Sites running WP Social Feed Gallery (insta-gallery) version 5.0.13 or earlier are affected. Sites that do not have the plugin installed or have it deactivated can skip this. The sources do not say which specific endpoints or roles are involved.
No product ranges from the sources yet.
wp plugin get insta-gallery --field=version5.0.13, as listed in the advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-114705")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.