CVE-2024-1318

MEDIUM

RSS Aggregator by Feedzy < 4.4.2 - Authenticated Arbitrary Post Creation via Missing Capability Check

Title source: llm
STIX 2.1

Description

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with Contributor access and above, who are normally restricted to only being able to create posts rather than pages, to draft and publish posts with arbitrary content.

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0052
EPSS Percentile 40.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
themeisle/RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator < 4.4.2
themeisle/rss_aggregator_by_feedzy < 4.4.2
Published Feb 29, 2024
Tracked Since Feb 18, 2026