{"id":"CVE-2026-114705","kind":"vulnerability","aliases":["CVE-2026-114705"],"related":[],"title":"WP Social Feed Gallery: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.","summary":"WP Social Feed Gallery (insta-gallery), a WordPress plugin by quadlayers, has a missing authorization check, so requests can reach functions that should be restricted. An attacker with access to the plugin's endpoints can perform actions their role should not allow.","severity":"medium","cvss":6.5,"epss":0.00266,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["insta-gallery","package","wordpress","wp-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get insta-gallery --field=version`\n- Confirm whether the plugin is active on the site","fix":"- Update WP Social Feed Gallery (insta-gallery) to a version later than `5.0.13`, as listed in the advisory\n- unknown: the sources do not name the patched version","status":"open","published_at":"2026-10-24T10:17:10+00:00","first_seen_at":"2026-10-24T10:47:22+00:00","triaged_at":"2026-10-25T03:47:05+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:47:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Social Feed Gallery (insta-gallery) to a version later than `5.0.13`, as listed in the advisory\n- unknown: the sources do not name the patched version","reach":"internet","title":"WP Social Feed Gallery: missing authorization lets users bypass access controls","impact":"medium","summary":"WP Social Feed Gallery (insta-gallery), a WordPress plugin by quadlayers, has a missing authorization check, so requests can reach functions that should be restricted. An attacker with access to the plugin's endpoints can perform actions their role should not allow.","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","insta-gallery"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users trigger restricted plugin actions on the site","analyst_note":"Check the NVD entry and the Wordfence or plugin changelog for the affected endpoints, required privilege, and patched version.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get insta-gallery --field=version`\n- Confirm whether the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WP Social Feed Gallery (insta-gallery) version 5.0.13 or earlier are affected. Sites that do not have the plugin installed or have it deactivated can skip this. The sources do not say which specific endpoints or roles are involved.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000616,"input_tokens":3319,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114705':14A,17A '-2026':13A,16A '5.0.13':98C 'access':10A,55B,85C 'action':63B 'affect':90C 'allow':68B,81C 'attack':53B 'author':6A,41B,70C 'bypass':9A 'check':42B 'configur':84C 'control':11A,86C 'cve':12A,15A 'endpoint':60B 'exploit':82C 'feed':3A,28B,76C,93C 'function':47B 'galleri':4A,20B,29B,32B,77C,80C,94C 'incorrect':83C 'insta':19B,31B,79C 'insta-galleri':18B,30B,78C 'issu':89C 'let':7A 'levels.this':88C 'miss':5A,40B,69C 'n/a':96C 'packag':21B 'perform':62B 'plugin':25B,35B,58B 'quadlay':37B,73C 'reach':46B 'request':44B 'restrict':51B 'role':65B 'secur':87C 'social':2A,27B,75C,92C 'user':8A 'vulner':71C 'wordpress':22B,34B 'wp':1A,24B,26B,74C,91C 'wp-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running WP Social Feed Gallery (insta-gallery) version 5.0.13 or earlier are affected. Sites that do not have the plugin installed or have it deactivated can skip this. The sources do not say which specific endpoints or roles are involved.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114705","severity":null,"published_at":"2026-10-24T10:17:10+00:00","modified_at":"2026-10-24T10:17:10+00:00","first_seen_at":"2026-10-24T10:47:22+00:00","fetched_at":"2026-10-24T10:47:22+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114705","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114705","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}