EUVD-2026-49244
GHSA-98xv-5xrc-6pmq
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level privileges required, high complexity due to SSRF bypass filters.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.
AnalysisAI
Server-side request forgery (SSRF) in the Feedzy WordPress plugin version 5.2.4 and below allows authenticated contributors to craft malicious RSS feed URLs, leading to unauthorized requests to internal or external resources. This could disclose limited internal service information or allow low-integrity modifications, but exploitation requires high attack complexity and contributor-level access. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Technical ContextAI
Feedzy is a WordPress plugin for importing and displaying RSS feeds, developed by Themeisle. The vulnerability resides in insufficient validation of user-provided feed URLs, enabling an attacker with contributor privileges to manipulate the URL to target arbitrary hosts, including internal networks. This is a classic Server-Side Request Forgery (CWE-918) where the application fails to restrict the destination of outbound HTTP requests initiated by feed fetching logic.
RemediationAI
The primary remediation is to update the Feedzy plugin to the latest patched version once it becomes available; however, the input data does not confirm a specific fix version. As a workaround, restrict contributor and higher roles from using or configuring feed URLs if not needed, implement web application firewall rules to block requests to private IP ranges or external domains not explicitly allowed, and disable the plugin if alternative feed solutions exist. Note that these compensating controls may break legitimate RSS feed functionality and require careful testing.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today