Executive brief
The Feeds for YouTube plugin for WordPress is used to display YouTube videos and galleries on websites. A security flaw allows any logged-in user, including those with low-level 'Subscriber' permissions, to delete the plugin's license key. This can result in the loss of premium features and disrupt the plugin's ability to fetch or display content correctly.
Technical details
The Feeds for YouTube plugin for WordPress (versions prior to 2.6.4) fails to implement proper authorization checks on its 'actions' function, specifically within the AJAX handler 'sby_recheck_connection'. This vulnerability allows authenticated users with Subscriber-level privileges or higher to send a crafted POST request to admin-ajax.php that triggers the deletion of critical license information stored in the WordPress options table (specifically 'sby_islicence_upgraded' and 'sby_upgraded_info'). An attacker can effectively deactivate premium functionality by wiping these license records. The issue is addressed in version 2.6.4.
Affected products
- Smash Balloon Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4
Timeline
- 2026-04-27: disclosed: Initial public disclosure by WPScan
- 2026-04-27: patched: Fixed in version 2.6.4
- 2026-05-18: advisory: NVD publication date