Feedzy RSS Aggregator CVE-2025-11467

No authentication required (PR:N) and no user interaction (UI:N): a remote attacker can reach the vulnerable feedzy_lazy_load code path on any internet-exposed WordPress site running the Feedzy RSS Aggregator plugin version 5.1.1 or earlier. Realistic impact is LIMITED by the BLIND nature of the SSRF - the attacker cannot directly read HTTP responses, so confidentiality gain depends on inference, timing, or targeting state-changing internal endpoints. Practical risk is amplified only where the WordPress host has reachable internal services (cloud instance metadata endpoints, internal admin panels, non-authenticated microservices); a hardened/egress-filtered deployment materially reduces exploitability.

Signals are consistent and point to a genuine but moderate-severity issue rather than a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, 5.8) describes a network-reachable, low-complexity, unauthenticated flaw with a scope change (the vulnerable WordPress app is coerced into reaching internal systems behind it) but only Low confidentiality impact and no integrity/availability impact - appropriate for a BLIND SSRF where the attacker cannot directly read responses. EPSS is low at 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, so this is not currently a mass-exploitation candidate. The description's claim that the flaw 'can be used to query and modify information from internal services' is broader than the assigned I:N - this is a latent conflict: realistic impact depends on what internal services exist (cloud metadata endpoints, unauthenticated admin APIs), and the blind nature caps practical confidentiality to inference rather than bulk data theft. Overall this warrants routine patching prioritization for exposed Feedzy installs, not emergency response.

An unauthenticated attacker sends a crafted request to the WordPress site invoking the feedzy_lazy_load function with an attacker-controlled URL, causing the server to issue an outbound request to an internal address such as a cloud metadata service (169.254.169.254) or an internal admin API. Because the SSRF is blind, the attacker infers results from timing/behavior or leverages state-changing internal endpoints rather than reading responses directly. No public exploit code was identified at time of analysis.