CVE-2026-1631

Description

The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4 is vulnerable to unauthorized modification of the Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4's license key due to a missing capability check on the 'actions' function. This makes it possible for subscribers and above delete the license key.

PUBLISHED Reserved 2026-01-29 | Published 2026-05-18 | Updated 2026-05-18 | Assigner WPScan

Problem types

CWE-862 Missing Authorization

Product status

Credits

Legion Hunter finder

WPScan coordinator

References

wpscan.com/...rability/b19596c2-69bc-4e15-8632-eb80f4577e3c/ exploit vdb-entry technical-description

cve.org (CVE-2026-1631)

nvd.nist.gov (CVE-2026-1631)

Download JSON