CVE-2026-18934: Feedzy RSS Plugin Auth Bypass Flaw

CVE-2026-18934 Overview

CVE-2026-18934 is a broken access control vulnerability in the RSS Aggregator by Feedzy WordPress plugin in versions before 5.2.6. The plugin fails to verify that the requesting user owns or is authorized to edit the import job named in the request. Authenticated users with author-level access or higher can manipulate import jobs owned by other users. Affected operations include permanently deleting posts created by another user's import job, resetting deduplication and scheduling state, disabling jobs, or clearing error logs. One affected action performs no object-type check, allowing arbitrary posts and pages to be unpublished regardless of ownership. The weakness is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Authenticated authors can delete content, unpublish arbitrary posts and pages, and disrupt import job state across the entire WordPress site.

Affected Products

RSS Aggregator by Feedzy WordPress plugin versions prior to 5.2.6
WordPress installations exposing author-level or higher accounts to untrusted users
Multi-author WordPress sites relying on Feedzy for automated content ingestion

Discovery Timeline

2026-08-10 - CVE-2026-18934 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18934

Vulnerability Analysis

The RSS Aggregator by Feedzy plugin exposes administrative actions for managing import jobs through authenticated endpoints. These endpoints accept an import job identifier from the requesting user but do not validate ownership or edit rights against the current user's capabilities. Any authenticated account with the edit_posts capability, typically the author role, can invoke these actions against jobs created by administrators or editors. The impact is amplified by one action that also omits an object-type check, so the same authorization gap can be used to unpublish arbitrary WordPress posts and pages outside the import job context.

Root Cause

The root cause is missing authorization enforcement on request handlers that mutate import job state. The plugin trusts the job identifier supplied by the caller and does not confirm the caller either owns the job or holds a capability that permits editing it. This matches the CWE-863 pattern of incorrect authorization, where an authentication check exists but authorization logic is either absent or applied inconsistently across code paths.

Attack Vector

Exploitation requires an authenticated session at author level or above and network access to the target WordPress site. An attacker submits a normal plugin action request while substituting a target import job identifier owned by another user. The server processes the request without an ownership check and applies the destructive operation. Successful requests delete imported posts permanently, reset scheduling and deduplication state to force reprocessing, disable the job, clear error logs to hide prior failures, or unpublish unrelated posts and pages. See the WPScan Vulnerability Overview for the technical write-up.

Detection Methods for CVE-2026-18934

Indicators of Compromise

Unexpected transitions of posts or pages from publish to draft or trash status in the wp_posts table
Sudden bulk deletion of posts associated with a Feedzy import job that a non-owning user recently accessed
Feedzy job error logs cleared without a corresponding administrator action in audit history
Import jobs disabled or rescheduled outside of normal administrative activity

Detection Strategies

Review WordPress admin-ajax.php and REST API access logs for Feedzy action names invoked by author-level accounts
Correlate post status changes in the database with the acting user_id recorded in revisions or activity logging plugins
Enable a WordPress audit log plugin to capture post deletions, unpublish events, and plugin option changes with user attribution

Monitoring Recommendations

Alert on any non-administrator account invoking Feedzy import job management actions
Monitor for high-volume post status changes performed by a single author account within a short interval
Track modifications to Feedzy job options and error logs and compare against expected administrator workflows

How to Mitigate CVE-2026-18934

Immediate Actions Required

Upgrade the RSS Aggregator by Feedzy plugin to version 5.2.6 or later on all WordPress installations
Audit author-level and higher user accounts, remove unused accounts, and rotate credentials for accounts with recent suspicious activity
Review recent post deletions and unpublish events for signs of exploitation and restore content from backups where necessary

Patch Information

The vendor addressed the authorization gap in RSS Aggregator by Feedzy version 5.2.6. The fix adds ownership and capability verification to the affected import job actions and enforces object-type validation on the action that previously accepted arbitrary post identifiers. Refer to the WPScan Vulnerability Overview for the disclosure record.

Workarounds

Restrict the author role and higher to trusted users until the plugin is updated
Temporarily deactivate the Feedzy plugin on sites that cannot immediately apply version 5.2.6
Use a WordPress role management plugin to remove edit_posts capability from untrusted accounts as an interim control

bash

# Update the Feedzy plugin using WP-CLI
wp plugin update feedzy-rss-feeds --version=5.2.6

# Verify installed version
wp plugin get feedzy-rss-feeds --field=version