Executive brief
The RSS Aggregator by Feedzy WordPress plugin fails to verify user permissions on import jobs, allowing authors and higher-level users to manipulate or delete import jobs and posts created by other users. An attacker can permanently delete imported posts, disable import jobs, or unpublish arbitrary posts and pages in the WordPress site, disrupting content publishing workflows and potentially causing data loss.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the Feedzy plugin's AJAX handlers for import job management. The plugin does not verify that the requesting user owns or is allowed to edit the targeted import job before processing actions like purge, import_status, run_now, or clear_error_logs. An authenticated user with author-level capability (publish_posts) can craft AJAX requests using a valid nonce to delete posts from other users' import jobs, reset job state, disable jobs, or unpublish arbitrary posts and pages regardless of ownership. The vulnerability requires authentication but no special user interaction; the attacker needs only a valid session and the job ID, which is exposed in the admin UI to any user viewing the import list.
Affected products
- Feedzy RSS Aggregator by Feedzy before 5.2.6
Timeline
- 2026-08-06: disclosed
- 2026-08-10: patched: Fix released in version 5.2.6