WordPress Plugin Vulnerabilities

Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

Description

The plugin does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

Proof of Concept

Affects Plugins

Plugin icon
private-feed-key
No known fix

References

CVE
CVE-2026-86707

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
fbf22345-4e8c-4719-a9c3-5e606b6fd77f

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2026-06-05
Title
Hippoo Mobile App for WooCommerce < 1.9.5 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
Published
2023-12-15
Title
Getwid < 2.0.3 - Unauthenticated Arbitrary Email Sending to Admin
Published
2026-06-22
Title
User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation
Published
2026-08-03
Title
Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter
Published
2024-11-05
Title
Social Share, Social Login and Social Comments Plugin – Super Socializer < 7.14 - Authentication Bypass