Security Alert Summary
The Private Feed Key WordPress plugin through version 0.1 contains an authentication bypass that does not verify that a provided feed key was actually issued by the plugin. Because the plugin matches any stored user metadata value instead of confirming ownership of the key, an unauthenticated attacker can authenticate as an arbitrary user, including administrators.
CVE Details
- CVE ID: CVE-2026-86707
- Affected component: Private Feed Key WordPress plugin
- Affected versions: through 0.1 (<= 0.1)
- Published: September 17, 2026 at 6:16:51 AM UTC
- Last modified: September 17, 2026 at 1:16:53 PM UTC
- CVSS v3.1 base score: 9.8
- CVSS v3.1 severity: CRITICAL
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Authentication: None required; Privileges required: None; User interaction: None; Attack vector: Network
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness: CWE-287 (Improper Authentication)
Technical Details
The plugin accepts a feed key supplied with a feed request and compares it to stored user metadata values, but it does not verify that the key was actually issued by the plugin for that user. This lack of proper verification (an authentication check) allows an attacker to present any metadata value that matches and be treated as that user by the plugin’s authentication mechanism.
The description does not name specific functions or REST endpoints; the core issue is the missing ownership verification of the feed key. The direct impact is that unauthenticated attackers can obtain an authenticated session as an arbitrary user, including accounts with administrative privileges, which may then be used to perform actions available to that user.
How This Could Impact Your Website
In a typical site with multiple WordPress users, an attacker could use an unauthenticated request to present a matching feed key and be authenticated as an existing user. For example, an external contractor or contributor with a stored feed key could be impersonated, or an attacker could directly target an administrator account if a matching value exists in user metadata. Consequences include exposure of internal user information, the ability to perform actions under another user’s identity, and an increased risk of targeted phishing or social engineering based on harvested user data.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially for contributors and contractors.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site and user activity for unusual logins or behavior indicating account misuse.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
