Is CVE-2026-66437 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66437 being exploited in the wild.

How severe is CVE-2026-66437?

Medium severity, with a CVSS score of 4.9, published 27 July 2026.

Which products and versions are affected?

Themeisle Feedzy RSS Feeds <= 5.2.4.

Is there a fix for CVE-2026-66437?

A patch was published on 2026-07-27: Fixed in version 5.2.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66437 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-66437?

Check whether you run Themeisle Feedzy RSS Feeds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66437: Themeisle Feedzy RSS Feeds SSRF in WordPress plugin

Q: Is there a fix for CVE-2026-66437?

A patch was published on 2026-07-27: Fixed in version 5.2.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66437 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-66437?

Check whether you run Themeisle Feedzy RSS Feeds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66437 · Severity: medium · CVSS 4.9 · Published 2026-07-27

Themeisle Feedzy RSS Feeds, a popular WordPress plugin used to aggregate and display RSS feeds, is vulnerable to a security flaw that could allow users with 'Contributor' level access to make the server perform unauthorized web requests. An attacker could use this to probe internal network services or access sensitive information that is not intended to be public. While the risk is considered medium, organizations should update the plugin to prevent internal network reconnaissance.

Vendors: Themeisle.

Quick answers

Is CVE-2026-66437 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66437 being exploited in the wild.
How severe is CVE-2026-66437?: Medium severity, with a CVSS score of 4.9, published 27 July 2026.
Which products and versions are affected?: Themeisle Feedzy RSS Feeds <= 5.2.4.
Is there a fix for CVE-2026-66437?: A patch was published on 2026-07-27: Fixed in version 5.2.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66437 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66437?: Check whether you run Themeisle Feedzy RSS Feeds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Themeisle Feedzy RSS Feeds plugin for WordPress (versions <= 5.2.4). The flaw allows an authenticated attacker with Contributor-level permissions or higher to induce the server to make requests to arbitrary domains or internal network resources. This is classified under CWE-918 and typically occurs due to insufficient validation of user-supplied URLs used in feed processing. An attacker can leverage this to perform internal port scanning or access metadata services in cloud environments. The issue is addressed in version 5.2.5.

Affected products

Themeisle Feedzy RSS Feeds <= 5.2.4

Timeline

2026-07-14: disclosed: Reported by Ananda Dhakal via Patchstack
2026-07-27: advisory: NVD and Patchstack published advisory details
2026-07-27: patched: Fixed in version 5.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.