CVE-2026-66437 Overview
CVE-2026-66437 is a Server-Side Request Forgery (SSRF) vulnerability in the Feedzy RSS Feeds plugin for WordPress, affecting versions up to and including 5.2.4. The flaw allows authenticated users with Contributor-level privileges to coerce the WordPress server into issuing HTTP requests to attacker-controlled or internal destinations. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated contributors can abuse the plugin's feed-fetching functionality to probe internal network resources, interact with cloud metadata endpoints, or exfiltrate limited response data from services reachable by the WordPress host.
Affected Products
- Feedzy RSS Feeds WordPress plugin versions <= 5.2.4
- WordPress sites running Feedzy with contributor-level user accounts enabled
- Hosting environments where the WordPress server has access to internal or cloud-metadata services
Discovery Timeline
- 2026-07-27 - CVE-2026-66437 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-66437
Vulnerability Analysis
The Feedzy RSS Feeds plugin fetches remote RSS/Atom feeds on behalf of authenticated users. In versions up to 5.2.4, a user holding the Contributor role can supply a feed URL that the server dereferences without adequate validation of the target host or scheme. The plugin then issues an outbound HTTP request from the WordPress server context and returns portions of the response into the editor workflow.
Because the request originates from the server, attackers can reach destinations that are not exposed to the public internet. Typical targets include 127.0.0.1, RFC1918 ranges, container link-local addresses, and cloud instance metadata endpoints such as 169.254.169.254. The attack requires authentication and elevated request crafting, which reduces the practical exploitation surface but does not eliminate the risk on multi-author WordPress sites.
Root Cause
The root cause is insufficient validation of user-supplied URLs prior to server-side dereferencing. The plugin lacks an allowlist of permitted schemes and hosts, does not resolve and reject requests targeting private or loopback ranges, and does not restrict redirects that could pivot from a public host to an internal target.
Attack Vector
A Contributor authenticates to the WordPress admin, invokes Feedzy functionality that accepts a remote feed URL, and supplies a URL pointing to an internal service. The server issues the request and processes the response as if it were an RSS feed. See the Patchstack SSRF Vulnerability Advisory for advisory details.
// Conceptual request flow (no verified PoC available)
// Contributor submits: https://attacker.example/redirect -> http://169.254.169.254/latest/meta-data/
// Server-side fetch follows redirect and returns metadata content into the feed parser
Detection Methods for CVE-2026-66437
Indicators of Compromise
- Outbound HTTP requests from the WordPress host to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses
- Requests from the WordPress server to cloud metadata endpoints such as 169.254.169.254
- Feedzy feed-import log entries referencing non-RSS content types or unusual response sizes
- Contributor accounts submitting feed URLs pointing to non-standard ports
Detection Strategies
- Inspect web server and PHP outbound request logs for connections initiated by wp-cron.php or Feedzy fetcher routines to internal addresses
- Correlate WordPress audit logs of feed-related actions with unusual destination hosts
- Deploy egress filtering telemetry to flag WordPress-originated traffic that violates expected destinations
Monitoring Recommendations
- Enable WordPress activity logging for Contributor role actions involving Feedzy
- Forward web server access, error, and outbound proxy logs to a central analytics platform for correlation
- Alert on any WordPress host request to link-local, loopback, or RFC1918 destinations
How to Mitigate CVE-2026-66437
Immediate Actions Required
- Update the Feedzy RSS Feeds plugin to a version newer than 5.2.4 as soon as a fixed release is available
- Audit user accounts and remove or downgrade unnecessary Contributor-level accounts
- Restrict egress traffic from the WordPress host to only required destinations at the network layer
Patch Information
Refer to the Patchstack advisory for Feedzy 5.2.4 SSRF for the vendor-supplied patched version and remediation guidance. Apply the update through the WordPress plugin management interface or via WP-CLI in staging before production rollout.
Workarounds
- Temporarily disable the Feedzy RSS Feeds plugin until the patched version is deployed
- Block outbound traffic from the WordPress server to 169.254.169.254, 127.0.0.0/8, and RFC1918 ranges using host firewall rules
- Require IMDSv2 on AWS instances hosting WordPress to prevent unauthenticated metadata retrieval
# Example iptables egress restriction on the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
