Executive brief
The Private Feed Key WordPress plugin allows unauthenticated attackers to log in as any user, including site administrators, by exploiting a weak authentication mechanism. An attacker can bypass login requirements by crafting a request with any value that matches stored user metadata, rather than a legitimate feed key. This enables complete account takeover and administrative access to WordPress sites running the affected plugin.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the Private Feed Key WordPress plugin through version 0.1. The plugin fails to verify that a supplied feedkey parameter is a legitimate key it previously issued; instead, it matches the parameter against any stored user metadata value. An unauthenticated attacker can log in as any user by providing a feedkey value that corresponds to an existing user's metadata field. No authentication, privileged access, or user interaction is required. The attack is network-reachable and allows account takeover including administrative access. No patch has been released as of the advisory date.
Affected products
- <UNKNOWN> Private Feed Key through 0.1
Timeline
- 2026-09-15: disclosed
- 2026-09-17: advisory