Feedzy import actions permit Author cross-user deletion and unpublishing
RSS Aggregator by Feedzy before 5.2.6 accepts an import-job identifier without verifying ownership or edit permission. An Author can permanently delete posts produced by another user's job, reset its deduplication and scheduling state, disable it or clear its error log. One affected action also omits an object-type check, allowing arbitrary posts and pages to be unpublished regardless of ownership.
- Component
- RSS Aggregator by Feedzy
- Plugin slug
feedzy-rss-feeds- Affected
- < 5.2.6
- Safe version
5.2.6- Published
- Aug 10, 2026
This CVE was published Aug 10, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
Update to 5.2.6 or later. Audit Author activity, import-job settings and unexpectedly deleted or unpublished content; restore affected posts and schedules from known-good records or backups.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N