Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-86707: Private Feed Key plugin allows anyone to log in
CVE-2026-86707 · published 25 days ago
Summary
The Private Feed Key WordPress plugin does not properly verify the key that authenticates feed requests, so an unauthenticated person can pretend to be any user, even an administrator. This means a stranger could gain full access to your site. Remove or replace the plugin with a maintained alternative, or apply any available security update immediately.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | private feed key | <= 0.1 |
Original advisory text
Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-287Improper Authentication
Timeline
Published17 Sep 2026
Updated11 Oct 2026
First seen17 Sep 2026
Track software like this
Free during beta