CVE-2026-86707
Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
| Vendor | unknown |
| Product | private feed key |
| Published | Sep 17, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown private feed key
Be the first to know when new critical vulnerabilities affecting unknown private feed key are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Private Feed Key
0 ≤ 0.1
References
Credits
Naoki Kawahigashi WPScan