CVE-2026-18934

Name of the Vulnerable Software and Affected Versions RSS Aggregator by Feedzy versions prior to 5.2.6

Description The plugin fails to verify if the requesting user owns or has permission to edit the specified import job. This allows users with author-level access or higher to permanently delete posts created by another user's import job, disable the job, clear its error log, or reset its scheduling and deduplication state. Additionally, due to a lack of object-type checks in one of the affected actions, arbitrary posts and pages can be unpublished regardless of ownership.

Recommendations Update RSS Aggregator by Feedzy to version 5.2.6 or later.