What is the CVSS score of EUVD-2026-55013?

EUVD-2026-55013 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-55013?

Yes, a public proof-of-concept exploit is available for EUVD-2026-55013. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-55013?

Yes, a patch is available for EUVD-2026-55013. Update the affected software to the latest version immediately.

Feedzy RSS Aggregator EUVD-2026-55013

| CVE-2026-18934 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-10 WPScan

GHSA-qfhm-px88-3xm7

WordPress Authentication Bypass Rss Aggregator By Feedzy Unknown

5.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

PR:L reflects author-level access per description; A:L added for post deletion and job disruption; C:N as no data exfiltration path is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:49 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

5.5 (MEDIUM)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 06:00 cve.org

MEDIUM 5.5

DescriptionCVE.org

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.

AnalysisAI

Broken object-level authorization in the RSS Aggregator by Feedzy WordPress plugin before 5.2.6 allows authenticated users with author-level access or higher to perform unauthorized actions against import jobs and content they do not own. Affected actions include permanently deleting posts generated by another user's import job, resetting deduplication and scheduling state, disabling jobs, and clearing error logs. Critically, one endpoint performs no object-type check at all, enabling any sufficiently privileged authenticated user to unpublish arbitrary posts and pages site-wide regardless of ownership. A publicly available exploit exists per WPScan; no active exploitation confirmed in CISA KEV at time of analysis.

Technical ContextAI

The RSS Aggregator by Feedzy plugin (CPE: cpe:2.3:a:unknown:rss_aggregator_by_feedzy:*:*:*:*:*:*:*:*) is a WordPress plugin that automates fetching, importing, and publishing content from external RSS feeds via user-defined import jobs. The root cause is CWE-863 (Incorrect Authorization): server-side endpoints that modify or delete import job resources accept a job identifier from the request but fail to verify that the requesting user has ownership or editorial rights over that specific object. This is a classic Insecure Direct Object Reference (IDOR) pattern. One action further lacks an object-type validation gate, extending the authorization bypass from import-job objects to arbitrary WordPress posts and pages, enabling content unpublishing across the full site. The vulnerability surface is WordPress's REST or AJAX action layer where plugin-registered handlers perform no ownership check beyond confirming the user holds at least the author role.

RemediationAI

Update the RSS Aggregator by Feedzy plugin to version 5.2.6 or later immediately, as this is the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/f87c5a11-59a1-47cc-bc1c-d12108b510ab/. The fix can also be cross-referenced at https://nvd.nist.gov/vuln/detail/CVE-2026-18934. If an immediate update is not possible, restrict the WordPress author role to trusted users only, removing or demoting any untrusted or external contributor accounts until patching is complete - note this may disrupt legitimate editorial workflows. Additionally, site administrators should audit import jobs and recent post publication history for unexpected modifications or mass unpublishing events as indicators of prior exploitation. There are no known configuration-level workarounds that address the underlying authorization bypass without code changes.