PT-2026-41635 · WordPress · Feeds For Youtube

Legion Hunter · CVE-2026-1631 · Published 2026-05-18 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Feeds for YouTube versions prior to 2.6.4

Description A missing capability check in the actions() function allows users with subscriber privileges or higher to unauthorizedly modify or delete the plugin license key.

Recommendations Update to version 2.6.4 or later. As a temporary workaround, restrict access to the actions() function to only authorized administrative users.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1631

Affected Products

Feeds For Youtube

References · 5

• 🔥 https://wpscan.com/vulnerability/b19596c2-69bc-4e15-8632-eb80f4577e3c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1631 · Security Note
• https://twitter.com/UndercodeUpdate/status/2066962618309382420 · Twitter Post
• https://t.me/CVEtracker/54097 · Telegram Post
• https://t.me/cveNotify/163817 · Telegram Post