Description
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with Contributor access and above, who are normally restricted to only being able to create posts rather than pages, to draft and publish posts with arbitrary content.
Published: 2024-02-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-17076 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with Contributor access and above, who are normally restricted to only being able to create posts rather than pages, to draft and publish posts with arbitrary content.
History

Wed, 08 Apr 2026 17:00:00 +0000

Type Values Removed Values Added
Title RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication

Tue, 22 Apr 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 31 Dec 2024 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Themeisle
Themeisle rss Aggregator By Feedzy
Weaknesses CWE-862
CPEs cpe:2.3:a:themeisle:rss_aggregator_by_feedzy:*:*:*:*:*:wordpress:*:*
Vendors & Products Themeisle
Themeisle rss Aggregator By Feedzy

Subscriptions

Themeisle Rss Aggregator By Feedzy
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:37:35.368Z

Reserved: 2024-02-07T16:38:39.144Z

Link: CVE-2024-1318

cve-icon Vulnrichment

Updated: 2024-08-01T18:33:25.377Z

cve-icon NVD

Status : Modified

Published: 2024-02-29T01:43:47.457

Modified: 2026-04-08T17:18:17.983

Link: CVE-2024-1318

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses