The Feeds for YouTube WordPress plugin before version 2.6.4 contains a missing capability check in its actions function. This flaw allows any user with the Subscriber role or higher to remove the plugin’s stored license data, effectively deleting the license key and disabling licensed features. The vulnerability does not provide arbitrary code execution or compromise of other components; it solely grants lower‑privileged users unauthorized modification of a critical plugin configuration.

Any WordPress site running Feeds for YouTube version 2.6.3 or earlier is vulnerable. No other vendors or product versions are mentioned.

EPSS score is not available and the issue is not listed in the CISA KEV catalogue. The CVSS score is not specified. Exploitation requires only that an attacker be authenticated with at least Subscriber privileges, a role that may exist on many sites. The impact is limited to deletion of license data, potentially rendering the plugin unusable but not exposing broader system compromise.