The RSS Aggregator by Feedzy plugin for WordPress suffers from a missing capability check (CWE-862) in specific functions ('feedzy_wizard_step_process' and 'import_status') across all versions up to 4.4.2. This authorization bypass enables authenticated users with Contributor or higher privileges to publish posts with arbitrary content, bypassing normal WordPress role restrictions. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, and low privileges required but no user interaction needed. There is no indication of known exploits in the wild, and the plugin is not a cloud service.

An attacker with Contributor or higher privileges can exploit this vulnerability to publish arbitrary posts, potentially leading to unauthorized content injection or misinformation on the affected WordPress site. The integrity of the site's published content is compromised. There is no impact on confidentiality or availability reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user capabilities or remove the plugin if possible. Monitor for updates from the vendor themeisle regarding patches addressing this missing authorization vulnerability.