CVE-2026-1631: Feeds for YouTube Auth Bypass Vulnerability

CVE-2026-1631 Overview

CVE-2026-1631 affects the Feeds for YouTube WordPress plugin (YouTube video, channel, and gallery plugin) in versions before 2.6.4. The plugin contains a missing capability check on the actions function, allowing authenticated users with subscriber-level access or higher to delete the plugin's license key. This represents a broken access control flaw classified under [CWE-862] Missing Authorization. The issue affects site administrators who rely on the plugin's licensed functionality, as any low-privileged authenticated user can disrupt the licensed feature set.

Critical Impact

Authenticated users with subscriber privileges or higher can delete the Feeds for YouTube plugin license key, disrupting licensed plugin functionality on affected WordPress sites.

Affected Products

• Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin
• All versions prior to 2.6.4
• WordPress sites with subscriber-level or higher user registration enabled

Discovery Timeline

• 2026-05-18 - CVE-2026-1631 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-1631

Vulnerability Analysis

The Feeds for YouTube plugin exposes an actions function that handles administrative operations including license key management. The function fails to verify the calling user's capabilities before executing privileged operations. This omission allows any authenticated user, including those with the minimal subscriber role, to invoke the function and delete the stored license key.

WordPress capability checks normally restrict administrative actions to users with roles such as administrator or editor. When a plugin handler accepts requests without calling current_user_can() or an equivalent verification, the WordPress permission model is bypassed entirely. The flaw is categorized as a Missing Authorization weakness ([CWE-862]).

The attack requires network access to the WordPress site and valid authenticated credentials at the subscriber level. No user interaction beyond the attacker's request is required. The vulnerability impacts integrity and availability of plugin configuration but does not expose confidential data.

Root Cause

The root cause is the absence of a capability check inside the plugin's actions handler. The function processes incoming requests and performs state-changing operations on plugin settings without confirming that the requesting user holds an appropriate role. License key deletion is therefore reachable from any authenticated session.

Attack Vector

An attacker first obtains or registers a subscriber account on a target WordPress site. The attacker then issues an authenticated HTTP request to the vulnerable actions endpoint with parameters that trigger license key deletion. The plugin executes the operation without verifying privileges, removing the license configuration. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-1631

Indicators of Compromise

• Unexpected removal or reset of the Feeds for YouTube plugin license key in WordPress options
• Authenticated POST or AJAX requests to the plugin's actions endpoint originating from subscriber accounts
• Plugin functionality reverting to unlicensed state without administrator action

Detection Strategies

• Review WordPress audit logs for changes to plugin option entries associated with Feeds for YouTube license storage
• Correlate wp-admin/admin-ajax.php or admin-post.php traffic with low-privileged user sessions invoking plugin actions
• Monitor for HTTP requests targeting the plugin's action handler from accounts that do not require administrative access

Monitoring Recommendations

• Enable WordPress activity logging plugins to record option changes and AJAX action invocations
• Alert on any modification to plugin license entries in the wp_options table
• Track subscriber account registrations followed shortly by requests to plugin administrative endpoints

How to Mitigate CVE-2026-1631

Immediate Actions Required

• Upgrade the Feeds for YouTube WordPress plugin to version 2.6.4 or later
• Audit existing subscriber and contributor accounts for legitimacy and remove unused accounts
• Disable open user registration if subscriber accounts are not required for site operation

Patch Information

The vendor addressed CVE-2026-1631 in Feeds for YouTube version 2.6.4 by adding the missing capability check to the actions function. Administrators should update through the WordPress plugin management interface. Confirm the installed version reports 2.6.4 or higher after applying the update. See the WPScan Vulnerability Report for the advisory.

Workarounds

• Temporarily deactivate the Feeds for YouTube plugin until the patched version is installed
• Restrict access to wp-admin/admin-ajax.php for non-administrative roles using a web application firewall rule
• Disable new user registration via WordPress General Settings to limit attacker access to subscriber accounts