The RSS Aggregator by Feedzy plugin for WordPress suffers from an improper access control vulnerability (CWE-284) because it lacks a proper capability check on its dashboard interface. This flaw allows authenticated users with contributor or higher privileges to modify feed categories they own without appropriate authorization checks. The vulnerability affects all versions up to and including 4.4.1. The CVSS 3.1 base score is 4.3, indicating medium severity, with the vector indicating network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker with contributor or higher privileges on a WordPress site using the vulnerable plugin can create, edit, or delete feed categories they have created. This unauthorized modification can affect the integrity of the feed data managed by the plugin but does not impact confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access carefully and monitor user actions related to feed categories. Avoid granting contributor or higher privileges to untrusted users. Follow vendor updates for a patch or official fix.