CVE-2026-18934: RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion
The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress-plugin/rss-aggregator-by-feedzyto a version that resolves this vulnerability.Fixed in 5.2.6 - Compensating control
If immediate upgrading is not possible, restrict who can access plugin import-job related endpoints/actions so author-level users cannot trigger import-job operations (delete/reset/disable/clear error log) for other users’ import jobs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18934?
CVE-2026-18934 has a risk score of 40, indicating a significant vulnerability.
How do I fix CVE-2026-18934?
To fix CVE-2026-18934, update the RSS Aggregator by Feedzy plugin to version 5.2.6 or later.
What is CVE-2026-18934?
CVE-2026-18934 is a vulnerability in the RSS Aggregator by Feedzy plugin that allows users with author-level access to delete posts from other users' import jobs.
Who is affected by CVE-2026-18934?
Users who have author-level access or higher in WordPress and use the RSS Aggregator by Feedzy plugin before version 5.2.6 are affected.
What can attackers do with CVE-2026-18934?
Attackers can use CVE-2026-18934 to permanently delete posts created by import jobs of other users.