Feedzy RSS Aggregator CVE-2025-11128

Exploitation requires an authenticated account with Subscriber-level privileges or above (PR:L) on a WordPress site running the Feedzy RSS Aggregator plugin version ≤5.1.0, and the ability to reach the feed-processing path that calls 'feedzy_sanitize_feeds'. The practical blast radius depends on what internal services are reachable from the web server (e.g., cloud metadata services, intranet hosts); the attack is remote and needs no user interaction, but is limited to confidentiality (reading responses from internal targets) with no integrity or availability impact. Sites that disable self-registration meaningfully raise the barrier since the attacker must first acquire a low-privilege account.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, 5.0 MEDIUM) describes a network-exploitable SSRF that requires only Subscriber-level authentication (PR:L) and no user interaction, with a scope change (S:C) reflecting that the vulnerable web app is coerced into reaching other systems, but limited confidentiality-only impact (C:L) and no integrity/availability effect. EPSS is low at 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so this is a real but moderate-priority issue rather than an urgent one. The signals are internally consistent: a self-reported Wordfence finding with a patch (changeset 3378828) and no evidence of active exploitation, meaning the practical risk is bounded by the need for an attacker to first obtain a Subscriber account (trivial on sites with open registration, impossible on those that disable it). The main value of SSRF here is internal reconnaissance / querying internal services (e.g., cloud metadata endpoints, intranet hosts), which can be a stepping-stone but by itself only yields C:L. No key data is missing or contradictory; the CVSS network vector matches the description of an authenticated remote web request.

An attacker registers or obtains a Subscriber-level account on a WordPress site running Feedzy ≤5.1.0, then invokes the feed-handling functionality so that 'feedzy_sanitize_feeds' fetches an attacker-supplied URL. By pointing it at internal addresses (e.g., http://169.254.169.254/ cloud metadata or internal service endpoints), the attacker makes the server issue requests to otherwise unreachable internal resources and reads returned information. No public proof-of-concept is referenced, so exploitation would require an attacker to craft the request from the documented function behavior.