A critical authentication bypass vulnerability in the Private Feed Key WordPress plugin allows unauthenticated attackers to gain full administrative access to affected sites.

The plugin suffers from improper authentication (CWE-287), where it fails to verify if a provided feed key was legitimately issued by the system. By matching against arbitrary user metadata, the plugin allows unauthenticated remote attackers to bypass login requirements and assume the identity of any registered user.

The vulnerability carries a CVSS score of 9.8, reflecting its critical severity due to the lack of required privileges and the total impact on confidentiality, integrity, and availability. Successful exploitation grants an attacker full administrative control over the WordPress installation, enabling unauthorized data exfiltration, total site compromise, and potential pivoting into the underlying server environment.

Immediate Action: As no patch is currently available, administrators must immediately deactivate and remove the Private Feed Key plugin from all affected WordPress environments.

Proactive Monitoring: Review web server and WordPress authentication logs for unusual login patterns or suspicious administrative activity originating from unrecognized sources.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized requests to feed-related endpoints, though total removal of the vulnerable code remains the only effective mitigation.

Public Exploit Available: Unknown

Given the critical nature of this authentication bypass and the lack of a verified patch, the risk to the organization is severe. Security teams must prioritize the immediate removal of the Private Feed Key plugin from all production instances to prevent unauthorized administrative takeover.