What is the CVSS score of CVE-2026-1631?

CVE-2026-1631 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-1631?

Yes, a public proof-of-concept exploit is available for CVE-2026-1631. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-1631?

Yes, a patch is available for CVE-2026-1631. Update the affected software to the latest version immediately.

Feeds for YouTube CVE-2026-1631

EUVD-2026-30735 MEDIUM

Missing Authorization (CWE-862)

2026-05-18 WPScan

GHSA-q2vf-5q2q-2gm5

WordPress Authentication Bypass Feeds For Youtube Youtube Video Channel And Gallery Plugin Unknown

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L reflects mandatory subscriber authentication; I:L and A:L capture license key deletion's bounded integrity and availability disruption; C:N as no data is exposed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:05 vuln.today

Patch available

May 18, 2026 - 09:01 EUVD

CVE Published

May 18, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 18, 2026 - 06:00 cve.org

MEDIUM 5.4

DescriptionCVE.org

The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4 is vulnerable to unauthorized modification of the Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4's license key due to a missing capability check on the 'actions' function. This makes it possible for subscribers and above delete the license key.

AnalysisAI

Missing authorization in the Feeds for YouTube WordPress plugin (all versions before 2.6.4) allows any authenticated subscriber-level user to delete the plugin's license key by invoking the unprotected 'actions' function. The integrity and availability impact is bounded to plugin-level disruption - premium features are disabled upon key deletion - with no confidentiality exposure. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.02% (4th percentile) and CISA KEV does not list active exploitation, indicating limited real-world threat activity despite accessible exploit code.

Technical ContextAI

The affected product is the Feeds for YouTube WordPress plugin, identified by CPE cpe:2.3:a:unknown:feeds_for_youtube_(youtube_video,_channel,_and_gallery_plugin):*:*:*:*:*:*:*:* across all versions prior to 2.6.4. The root cause is CWE-862 (Missing Authorization): the plugin's 'actions' AJAX handler does not perform a WordPress capability check (e.g., current_user_can()) before executing privileged operations, specifically license key deletion. In the WordPress permission model, 'subscriber' is the lowest authenticated role and carries no administrative capabilities, making this a straightforward privilege escalation at the application layer. The missing nonce or capability guard is a common WordPress plugin anti-pattern that WPScan routinely identifies.

RemediationAI

Update the Feeds for YouTube WordPress plugin to version 2.6.4 or later, which introduces the missing capability check on the 'actions' function. This is confirmed as a vendor-released patch per the WPScan advisory (https://wpscan.com/vulnerability/b19596c2-69bc-4e15-8632-eb80f4577e3c/) and EUVD-2026-30735. If immediate patching is not possible, restrict WordPress user registration to prevent untrusted parties from obtaining subscriber accounts (Settings > General > uncheck 'Anyone can register'), which eliminates the low-privilege attack surface. Alternatively, a WAF rule blocking unauthorized AJAX calls to the plugin's 'actions' endpoint can serve as a temporary compensating control, though this may break legitimate plugin functionality. Deactivating the plugin entirely is the most effective interim control if YouTube feed functionality is non-essential.