Is CVE-2026-1631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1631 being exploited in the wild.

How severe is CVE-2026-1631?

Informational severity, with a CVSS score of 5.4, published 18 May 2026.

Which products and versions are affected?

Smash Balloon Feeds for YouTube < 2.6.4.

Is there a fix for CVE-2026-1631?

A patch was published on 2026-04-27: Fixed in version 2.6.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1631 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1631?

Check whether you run Smash Balloon Feeds for YouTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1631: Smash Balloon Feeds for YouTube unauthorized license deletion

Q: Is there a fix for CVE-2026-1631?

A patch was published on 2026-04-27: Fixed in version 2.6.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-1631 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-1631?

Check whether you run Smash Balloon Feeds for YouTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1631 · Severity: info · CVSS 5.4 · Published 2026-05-18

The Feeds for YouTube plugin for WordPress is used to display YouTube videos and galleries on websites. A security flaw allows any logged-in user, including those with low-level 'Subscriber' permissions, to delete the plugin's license key. This can result in the loss of premium features and disrupt the plugin's ability to fetch or display content correctly.

Vendors: Smash Balloon.

Quick answers

Is CVE-2026-1631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1631 being exploited in the wild.
How severe is CVE-2026-1631?: Informational severity, with a CVSS score of 5.4, published 18 May 2026.
Which products and versions are affected?: Smash Balloon Feeds for YouTube < 2.6.4.
Is there a fix for CVE-2026-1631?: A patch was published on 2026-04-27: Fixed in version 2.6.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1631 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1631?: Check whether you run Smash Balloon Feeds for YouTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Feeds for YouTube plugin for WordPress (versions prior to 2.6.4) fails to implement proper authorization checks on its 'actions' function, specifically within the AJAX handler 'sby_recheck_connection'. This vulnerability allows authenticated users with Subscriber-level privileges or higher to send a crafted POST request to admin-ajax.php that triggers the deletion of critical license information stored in the WordPress options table (specifically 'sby_islicence_upgraded' and 'sby_upgraded_info'). An attacker can effectively deactivate premium functionality by wiping these license records. The issue is addressed in version 2.6.4.

Affected products

Smash Balloon Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4

Timeline

2026-04-27: disclosed: Initial public disclosure by WPScan
2026-04-27: patched: Fixed in version 2.6.4
2026-05-18: advisory: NVD publication date

References

https://wpscan.com/vulnerability/b19596c2-69bc-4e15-8632-eb80f4577e3c/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.