CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86707

The Private Feed Key WordPress plugin (through 0.1 ) suffers from an unauthenticated authentication bypass via the feedkey parameter. The plugin fails to verify that the key supplied in a feed request is one it issued, instead matching the key against any stored user metadata value . This allows ...