Description

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-17T06:16:51.213Z",
  "pubdate": "2026-09-17T06:16:51.213Z",
  "executiveSummary": "The Private Feed Key WordPress plugin (through version 0.1) suffers from a critical authentication bypass vulnerability due to improper input validation of security tokens.\nThis vulnerability allows unauthenticated remote attackers to gain unauthorized access to the application by impersonating any user, including those with administrative privileges.\nThe root cause lies in the plugin's failure to verify that a provided feed key was explicitly issued by the system, instead accepting any value that matches a stored metadata entry for any user on the platform.\nSuccessful exploitation results in complete account takeover, exposing sensitive user data and granting full control over the WordPress environment.\nThe vulnerability requires no authentication or special privileges to exploit, making it highly critical for security posture.\nOrganizations using this plugin are exposed to significant risk of unauthorized system modification and data breaches.",
  "technicalDetails": "The vulnerability resides within the authentication logic of the Private Feed Key plugin, specifically in how the plugin validates user-supplied keys provided during feed requests.\nUnder normal operating conditions, an authentication token should be uniquely linked to a specific user session and verified against a secure, server-side generated record.\nThe flaw manifests because the plugin performs a loose lookup during the validation process. Instead of verifying the integrity and origin of the key against a whitelist or a specific user-associated cryptographic hash, the plugin executes a global search for the provided string within the WordPress user metadata (usermeta) table.\nIf the provided key matches any value stored in the user metadata of any registered account, the plugin incorrectly assumes the request is authorized for that specific user account.\nAttack flow: An attacker identifies that the plugin uses a predictable or discoverable metadata key to facilitate private feed access. By intercepting a feed request or brute-forcing a known valid metadata value belonging to any user, the attacker can supply this value to the authentication endpoint.\nUpon receiving the malicious request, the plugin queries the user metadata database to find a matching entry. Because the plugin does not enforce a strict association between the requester and the specific user record being accessed, it returns an authenticated session context for the owner of the found metadata.\nIf the metadata happens to belong to an administrator account, the attacker gains full administrative access to the WordPress dashboard.\nThis vulnerability is classified as an authentication bypass (CWE-287) caused by improper verification of credentials. The exploit is executed over the network without requiring any prior user account, bypasses the need for passwords or multi-factor authentication, and operates through standard HTTP requests directed at the feed endpoint.\nThe post-exploitation impact includes the potential for remote code execution via plugin/theme file editing, creation of new administrative accounts, exfiltration of sensitive site configuration data, and modification of existing content. Since the vulnerability relies on a fundamental flaw in the authentication check rather than a configuration error, there is no mitigation available other than code-level remediation of the validation logic."
}