CVE-2023-6805: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to modify information from internal services. NOTE: This vulnerability, exploitable by contributor-level users, was was fixed in version 4.4.7. The same vulnerability was fixed for author-level users in version 4.4.8.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6805?
CVE-2023-6805 is categorized as a high-severity vulnerability due to the potential for authenticated attackers to exploit it.
How do I fix CVE-2023-6805?
To fix CVE-2023-6805, update the RSS Aggregator by Feedzy plugin to version 4.4.8 or later.
Who is affected by CVE-2023-6805?
CVE-2023-6805 affects all users of the RSS Aggregator by Feedzy plugin for WordPress versions up to and including 4.4.7.
What exploitation methods are possible for CVE-2023-6805?
Exploitation of CVE-2023-6805 can occur through blind server-side request forgery via the fetch_feed functionality.
Is CVE-2023-6805 under active exploitation?
As of the latest information, there have been indications that CVE-2023-6805 may be under active exploitation.