Unauthorized Modification in Feeds for YouTube WordPress Plugin by Vendor
CVE-2026-1631
Currently unrated
What is CVE-2026-1631?
The Feeds for YouTube plugin, which integrates YouTube video, channel, and gallery functionalities, is susceptible to unauthorized modifications due to a lack of capability checks on the 'actions' function. This vulnerability allows users with subscriber privileges or higher to delete the plugin's license key, potentially leading to disruptions in functionality and unauthorized usage.
Affected Version(s)
Feeds for YouTube (YouTube video, channel, and gallery plugin) 0 < 2.6.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.