Unauthorized Data Modification in Feedzy RSS Aggregator Plugin for WordPress

CVE-2024-1318

Summary

The Feedzy RSS Aggregator plugin for WordPress contains a significant vulnerability that allows authenticated users, specifically those with Contributor privileges and above, to bypass intended restrictions. Due to missing capability checks in the 'feedzy_wizard_step_process' and 'import_status' functions, these users are able to draft and publish posts with arbitrary content, undermining the integrity of the site's content management. This issue affects all versions up to and including 4.4.2, and underscores the importance of implementing robust access controls to prevent unauthorized modifications.

References