What is the CVSS score of CVE-2026-8976?

CVE-2026-8976 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Feedzy RSS Aggregator CVE-2026-8976

EUVD-2026-34932 MEDIUM

Missing Authorization (CWE-862)

2026-06-06 security@wordfence.com

GHSA-x4h7-xv75-wrr5

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 00:32 vuln.today

CVE Published

Jun 06, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The RSS Aggregator by Feedzy - Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create and execute RSS import jobs, purge (force-delete) all posts associated with any import job, clear import error logs, and enumerate taxonomy terms and post meta_key names. The nonce required to reach these sub-handlers is leaked to any user with the edit_posts capability via the feedzyjs localized script injected into the block editor, meaning no privileged nonce theft or separate exploit step is required for Contributor-level users.

AnalysisAI

Authorization bypass in the RSS Aggregator by Feedzy WordPress plugin (all versions through 5.1.7) allows authenticated contributors to perform privileged import management actions - including force-deleting all posts tied to any import job, creating and executing RSS imports, clearing error logs, and enumerating taxonomy terms and post meta keys. The attack surface is widened by a nonce leak: the required nonce is exposed to any user holding the edit_posts capability via the feedzyjs localized script injected into the WordPress block editor, eliminating the need for any separate token-theft step. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.

Technical ContextAI

The vulnerability resides in the Feedzy RSS Feeds WordPress plugin's import management subsystem, specifically within feedzy-rss-feeds-import.php at multiple AJAX sub-handler endpoints (lines 1256, 1365, 1400, 1436, 3718, 3891, 4090, 4184 in the 5.1.2 and 5.1.5 tags). The root cause is CWE-862 (Missing Authorization): the plugin registers AJAX actions that handle sensitive operations - job creation, job execution, post purge, log clearing, and taxonomy enumeration - without verifying that the requesting user holds the capability level necessary to perform those actions. Authentication via nonce is present, but nonce possession is conflated with authorization. The nonce itself is injected into the block editor's JavaScript context (feedzy-rss-feeds-gutenberg-block.php line 78; feedzy-rss-feeds.php line 241) as part of the feedzyjs localized object, making it readable to any authenticated user with the edit_posts capability - a capability granted by default to the Contributor role in WordPress. This means the missing capability check cannot be compensated for by nonce secrecy alone.

RemediationAI

Update the Feedzy RSS Aggregator plugin to a version beyond 5.1.7 as soon as a patched release is available via the WordPress plugin repository (https://wordpress.org/plugins/feedzy-rss-feeds/). The CVE description bounds the vulnerability at 5.1.7 inclusive, but a confirmed fixed version number was not present in the provided data - verify the changelog on the plugin's WordPress.org page before updating to confirm the fix is included. While awaiting a patch, site administrators should audit and reduce the number of accounts holding the Contributor role or the edit_posts capability, as these are necessary preconditions for exploitation. Disabling the block editor (Gutenberg) would prevent the feedzyjs nonce leak mechanism, but this is a high-impact operational change. Alternatively, a Web Application Firewall rule blocking unauthenticated or contributor-level AJAX requests to the specific feedzy import action endpoints (wp-admin/admin-ajax.php with feedzy import-related actions) can reduce exposure with lower operational impact. Note that removing Contributor access eliminates the primary attack path on most WordPress sites.