Unauthorized Data Modification in RSS Aggregator Plugin for WordPress
CVE-2024-6621
4.3MEDIUM
Summary
The RSS Aggregator plugin for WordPress, specifically versions up to and including 4.23.11, has a vulnerability that allows authenticated users with Subscriber-level access or higher to manipulate RSS feeds without proper authorization checks. This issue arises from a lack of capability verification in the 'wprss_activate_feed_source' and 'wprss_pause_feed_source' functions, potentially enabling attackers to activate or pause RSS feeds maliciously, thereby compromising data integrity and feed functionality.
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published