Feeds For Youtube Youtube Video Channel And Gallery Plugin
Monthly
Missing authorization in the Feeds for YouTube WordPress plugin (all versions before 2.6.4) allows any authenticated subscriber-level user to delete the plugin's license key by invoking the unprotected 'actions' function. The integrity and availability impact is bounded to plugin-level disruption - premium features are disabled upon key deletion - with no confidentiality exposure. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.02% (4th percentile) and CISA KEV does not list active exploitation, indicating limited real-world threat activity despite accessible exploit code.
Missing authorization in the Feeds for YouTube WordPress plugin (all versions before 2.6.4) allows any authenticated subscriber-level user to delete the plugin's license key by invoking the unprotected 'actions' function. The integrity and availability impact is bounded to plugin-level disruption - premium features are disabled upon key deletion - with no confidentiality exposure. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.02% (4th percentile) and CISA KEV does not list active exploitation, indicating limited real-world threat activity despite accessible exploit code.