CVE-2026-8976: Feedzy WordPress Plugin Auth Bypass Flaw

CVE-2026-8976 Overview

CVE-2026-8976 affects the Feedzy RSS Aggregator plugin for WordPress in all versions up to and including 5.1.7. The plugin fails to verify user authorization before executing several sub-handlers in feedzy-rss-feeds-import.php. Authenticated users with Contributor-level access or above can create and execute RSS import jobs, force-delete posts associated with any import job, clear import error logs, and enumerate taxonomy terms and post meta_key names. The nonce required to reach these handlers is leaked through the feedzyjs localized script injected into the block editor for any user with the edit_posts capability. This removes the need for separate nonce theft and lowers the bar for exploitation.

Critical Impact
Contributor-level WordPress users can trigger arbitrary RSS imports, purge posts tied to any import job, and enumerate internal metadata on affected sites.

Affected Products

Feedzy RSS Aggregator plugin for WordPress, versions <= 5.1.7
WordPress sites running the Feedzy RSS Feeds plugin with Contributor or higher accounts
Sites exposing the block editor (edit_posts capability) to untrusted contributors

Discovery Timeline

2026-06-06 - CVE-2026-8976 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-8976

Vulnerability Analysis

The weakness is classified as a missing authorization flaw [CWE-862]. The Feedzy plugin exposes an admin-ajax dispatcher that routes to multiple sub-handlers responsible for import job management. The dispatcher checks a shared nonce but does not enforce a capability check that matches the sensitivity of each sub-action. As a result, any authenticated user who can obtain the nonce can invoke privileged operations meant for editors and administrators.

The attack is network-reachable, requires low privileges, and needs no user interaction. The integrity impact is limited to the data the plugin manages: import jobs, imported posts, error logs, and taxonomy or meta enumeration. Confidentiality and availability impact at the WordPress site level are not directly affected, but mass deletion of posts tied to an import job represents a meaningful data loss vector.

Root Cause

The sub-handlers referenced at lines such as 1256, 1365, 1400, 1436, 3718, 3891, 4090, and 4184 of includes/admin/feedzy-rss-feeds-import.php rely solely on nonce validation. They omit a current_user_can() check appropriate to actions like running imports or purging posts. The nonce itself is generated in feedzy-rss-feeds.php and surfaced to the block editor via wp_localize_script in includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php. Any user with edit_posts receives the nonce in page source, eliminating the authentication step that nonces are intended to backstop.

Attack Vector

An attacker logs in as a Contributor, opens any block editor page, and reads the localized feedzyjs JavaScript object to recover the nonce. The attacker then issues authenticated AJAX requests to the Feedzy import action with sub-handler parameters that trigger import execution, post purging, log clearing, or taxonomy and meta enumeration. No further privilege escalation step is required because the vulnerable handlers never re-validate the user's role.

Verified proof-of-concept code is not published in the enriched advisory data. See the Wordfence Vulnerability Analysis and the WordPress Changeset Information for the patch diff and handler references.

Detection Methods for CVE-2026-8976

Indicators of Compromise

Unexpected admin-ajax.php POST requests carrying Feedzy import actions originating from Contributor accounts.
New or modified Feedzy import jobs that no administrator created.
Sudden disappearance of posts associated with a Feedzy import job, consistent with the purge sub-handler.
Cleared Feedzy import error logs without a corresponding administrator action.

Detection Strategies

Hunt WordPress access logs for admin-ajax.php requests with Feedzy-specific action and sub-action parameters issued by non-editor users.
Correlate WordPress audit trails (user role, request URI, timestamp) against post deletion and import job creation events.
Flag any Contributor session that loads the block editor and immediately issues authenticated AJAX calls to Feedzy endpoints.

Monitoring Recommendations

Forward WordPress web server logs and plugin audit logs to a centralized analytics platform such as Singularity Data Lake for OCSF-normalized correlation across user, request, and content-change events.
Alert on bulk wp_posts deletions tied to a single Contributor session within a short time window.
Track changes to the installed Feedzy plugin version and confirm upgrades reach 5.1.8 or later across all sites.

How to Mitigate CVE-2026-8976

Immediate Actions Required

Update the Feedzy RSS Aggregator plugin to a version later than 5.1.7 on every WordPress instance.
Audit Contributor and Author accounts and remove any that are unused, shared, or untrusted.
Review Feedzy import jobs, imported posts, and error logs for unauthorized changes that may predate patching.

Patch Information

The vendor addressed the missing authorization checks in the changeset published at the WordPress Plugin Repository changeset 3552062. Site operators should upgrade to the first Feedzy release that ships this fix and confirm the plugin version via the WordPress admin Plugins page.

Workarounds

Restrict the Contributor and Author roles using a capability manager so that the edit_posts capability cannot reach the Feedzy block, preventing nonce exposure.
Place a Web Application Firewall rule that blocks admin-ajax.php requests carrying Feedzy import sub-actions from users below Editor role.
Temporarily deactivate the Feedzy plugin on sites where untrusted contributor accounts exist and patching is not yet feasible.

bash

# Example WP-CLI workflow to patch and verify
wp plugin update feedzy-rss-feeds
wp plugin get feedzy-rss-feeds --field=version
wp user list --role=contributor --fields=ID,user_login,user_email