CVE-2026-86707

Name of the Vulnerable Software and Affected Versions Private Feed Key versions prior to 0.2

Description The Private Feed Key WordPress plugin fails to verify that the key used to authenticate a feed request was actually issued by the plugin. Instead, it matches the key against any stored user metadata value. This flaw allows unauthenticated attackers to bypass authentication and log in as any user, including those with administrator privileges, by manipulating the feedkey parameter.

Recommendations Update the Private Feed Key plugin to a version newer than 0.1.