The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress suffers from a missing capability check in the wprss_ajax_send_premium_support function in all versions up to and including 4.23.12. This authorization flaw enables authenticated attackers with Subscriber-level privileges or above to send premium support requests with attacker-controlled subject lines and email addresses, effectively impersonating the site owner. Additionally, license information may be exposed due to this vulnerability. The CVSS 3.1 base score is 4.3, reflecting a medium severity impact with low complexity and no user interaction required.

Authenticated users with minimal privileges (Subscriber or higher) can exploit this vulnerability to impersonate the site owner by sending premium support requests with arbitrary subject lines and email addresses. This could lead to social engineering or trust abuse scenarios involving the plugin's support channel. License information leakage may also occur, potentially exposing sensitive licensing details. There is no indication of direct code execution or site takeover from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for unusual premium support request activity. Avoid granting unnecessary privileges to users and consider disabling or limiting the plugin's premium support request functionality if feasible.