CVE-2026-1631 is a missing authorization vulnerability in the Feeds for YouTube WordPress plugin (versions before 2.6.4). The flaw arises from the lack of a proper capability check in the 'actions' function, enabling users with subscriber or higher privileges to delete the plugin's license key. This unauthorized modification could affect plugin functionality or licensing status. There is no CVSS score assigned, and no vendor advisory or patch information is provided at this time.

The vulnerability allows unauthorized users with subscriber-level access or higher to delete the plugin's license key. This could disrupt the plugin's licensed features or cause denial of service related to licensing. There is no evidence of exploitation in the wild, and the impact is limited to license key deletion rather than direct code execution or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions if possible or monitor plugin updates closely to apply any forthcoming patches promptly.