What is GHSA-3m5h-9m27-j5hm?

GHSA-3m5h-9m27-j5hm is a security advisory published by GitHub Security Advisories with Critical severity. The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to...

Which CVE IDs does GHSA-3m5h-9m27-j5hm cover?

GHSA-3m5h-9m27-j5hm covers the following CVE IDs: CVE-2026-86707. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3m5h-9m27-j5hm?

GHSA-3m5h-9m27-j5hm has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-3m5h-9m27-j5hmCriticalCVSS 9.8

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-86707 →

📋 Description

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86707
https://wpscan.com/vulnerability/fbf22345-4e8c-4719-a9c3-5e606b6fd77f
https://github.com/advisories/GHSA-3m5h-9m27-j5hm