The Sync Feedly plugin for WordPress includes a missing or incorrect nonce validation in the crsf_cron_job_func function. This flaw allows an attacker to forge a request that triggers a content synchronization operation. If an administrator falls for a crafted link, the plugin may create multiple posts automatically, leading to spam or unwanted content on the site. The vulnerability does not grant arbitrary code execution, but it does permit unauthenticated creation of content through an administrator’s session.

WordPress sites running the Sync Feedly plugin from cristianr909090, versions up to and including 1.0.1, are affected.

The CVSS score of 4.3 indicates a moderate impact. The EPSS score of <1% suggests low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a cross‑site request where an administrator is authenticated, and an attacker lures the admin to click a malicious link. The attack vector is user interaction, making it less likely to be automated but still feasible if phishing or social engineering succeeds.