CVE-2026-86707: Private Feed Key WordPress Auth Bypass Flaw

CVE-2026-86707 Overview

CVE-2026-86707 is an authentication bypass vulnerability in the Private Feed Key WordPress plugin through version 0.1. The plugin fails to verify that a feed key presented for authentication was actually issued by the plugin itself. Instead, it matches the supplied key against any stored value in user metadata. Unauthenticated attackers can leverage this flaw to log in as any user, including administrators, resulting in complete site takeover. The weakness is classified under [CWE-287] Improper Authentication.

Critical Impact
Remote, unauthenticated attackers can authenticate as any WordPress user, including administrators, without valid credentials.

Affected Products

Private Feed Key WordPress plugin, all versions through 0.1
WordPress sites with the plugin installed and activated
Any user account exposed through the affected plugin, including administrator accounts

Discovery Timeline

2026-09-17 - CVE-2026-86707 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-86707

Vulnerability Analysis

The Private Feed Key plugin implements per-user feed authentication by issuing a secret key that a subscriber includes when requesting a private feed. The plugin then queries WordPress user metadata to identify the account associated with the request. The authentication routine performs an overly broad lookup, comparing the submitted key to any stored user meta value rather than validating it against the specific meta key reserved for feed authentication tokens. This logic error collapses the authentication boundary between arbitrary metadata and issued feed keys.

Root Cause

The root cause is improper authentication logic that trusts a metadata match as proof of identity. Because WordPress user_meta can contain many values populated by other plugins, themes, or user profile fields, any predictable or attacker-known metadata value can satisfy the check. The plugin does not scope the query to the intended meta_key, does not verify the format of the key, and does not confirm that the key was issued through the plugin's own generation function.

Attack Vector

An unauthenticated attacker sends a crafted feed request over the network containing a value that happens to appear in any user's metadata. When the plugin resolves the lookup to a user record, it establishes an authenticated session for that account. By iterating candidate values or supplying values known from public profile fields, an attacker can target a specific administrator account. Successful exploitation grants full administrative control, enabling plugin installation, arbitrary content changes, and code execution through the WordPress admin interface.

Detailed technical analysis is available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-86707

Indicators of Compromise

Feed request URLs containing unexpected key parameters that resolve to administrator sessions
Successful administrator logins immediately following requests to feed endpoints such as /?feed= variants
New administrator accounts, plugin installations, or theme edits with no corresponding console login activity
Access log entries from unfamiliar IP addresses targeting feed URLs with varying key values

Detection Strategies

Inspect web server access logs for high-volume requests to WordPress feed endpoints containing key parameters
Correlate feed endpoint requests with subsequent authenticated administrative actions in the same session
Alert on WordPress audit events showing privileged operations from IPs that first appeared on feed URLs
Flag installations of the Private Feed Key plugin at version 0.1 or lower during asset inventory scans

Monitoring Recommendations

Enable verbose WordPress authentication logging and forward events to a centralized SIEM for correlation
Monitor for administrator account creation, role changes, and plugin uploads outside change windows
Track outbound requests from the WordPress host that could indicate post-exploitation callbacks

How to Mitigate CVE-2026-86707

Immediate Actions Required

Deactivate and remove the Private Feed Key plugin from all WordPress installations until a fixed release is published
Rotate credentials and application passwords for all administrator and privileged accounts on affected sites
Review the WordPress user list for unauthorized accounts and revert unauthorized configuration changes
Audit installed plugins, themes, and wp-content directories for webshells or backdoors introduced during the exposure window

Patch Information

No patched version of the Private Feed Key plugin is referenced in the advisory at time of publication. Administrators should remove the plugin until the maintainer releases a version that restricts the metadata lookup to a dedicated meta_key and validates key format and issuance. Monitor the WPScan Vulnerability Report for updates.

Workarounds

Block requests to WordPress feed endpoints with key parameters at the web application firewall or reverse proxy
Restrict access to feed URLs to authenticated internal users through HTTP authentication or IP allowlisting
Disable the plugin at the filesystem level by renaming its directory under wp-content/plugins/ if administrative access is unavailable

bash

# Configuration example: disable the plugin via WP-CLI and block feed key parameters at the edge
wp plugin deactivate private-feed-key
wp plugin delete private-feed-key

# Example NGINX rule to block feed requests carrying a key parameter
# location ~* /feed { if ($arg_key) { return 403; } }