Private Feed Key
Monthly
Unauthenticated attackers can log in as any WordPress user, including administrators, on sites running the Private Feed Key plugin at version 0.1 or below, because the plugin's feed-authentication check accepts any value already stored in a user's metadata instead of verifying a key that the plugin itself issued. The issue is network-reachable with no authentication or user interaction required (CVSS 3.1 9.8, CWE-287, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists; no CISA KEV listing is indicated in the available intelligence supplied for this analysis. Exposure hinges solely on whether this obscure plugin is installed and active - no non-default configuration, special platform, or privileged position is needed - which is why the independent assessment rates it a genuine top-priority vulnerability rather than a high-score-but-low-risk case.
Unauthenticated attackers can log in as any WordPress user, including administrators, on sites running the Private Feed Key plugin at version 0.1 or below, because the plugin's feed-authentication check accepts any value already stored in a user's metadata instead of verifying a key that the plugin itself issued. The issue is network-reachable with no authentication or user interaction required (CVSS 3.1 9.8, CWE-287, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists; no CISA KEV listing is indicated in the available intelligence supplied for this analysis. Exposure hinges solely on whether this obscure plugin is installed and active - no non-default configuration, special platform, or privileged position is needed - which is why the independent assessment rates it a genuine top-priority vulnerability rather than a high-score-but-low-risk case.