by Kastro
Paper/Archive/CVE-2026-86707

CVE-2026-86707

Unknown Private Feed Key — Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.7.427 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

Affected

ProductAffectedFixed inSource
Private Feed Key≤ 0.1–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/fbf22345-4e8c-4719-a9c3-5e606b6fd77f