The Feeds for YouTube WordPress plugin before version 2.6.4 contains a missing capability check in its actions function. This flaw allows any user with the Subscriber role or higher to remove the plugin’s stored license data, effectively deleting the license key and disabling licensed features. The vulnerability does not provide arbitrary code execution or compromise of other components; it solely grants lower‑privileged users unauthorized modification of a critical plugin configuration.

Any WordPress site running Feeds for YouTube version 2.6.3 or earlier is vulnerable. No other vendors or product versions are mentioned.

The EPSS score of < 1% indicates a low but nonzero exploitation probability. The CVSS score of 5.4 indicates medium severity. It is not listed in CISA KEV. Exploitation requires authentication with at least Subscriber privileges, a role that may exist on many sites. An attacker can delete the license key, potentially rendering the plugin unusable but not exposing broader system compromise.