The RSS Aggregator by Feedzy plugin for WordPress contains an SSRF vulnerability (CWE-918) in the 'feedzy_sanitize_feeds' function affecting all versions up to 5.1.0. This flaw allows authenticated users with at least Subscriber privileges to cause the server to send HTTP requests to arbitrary locations. This can be leveraged to access internal network resources or services that are not otherwise accessible externally. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.0 (Network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, low confidentiality impact, no integrity or availability impact). No patch or official fix has been disclosed yet.

An attacker with Subscriber-level access or higher can exploit this SSRF vulnerability to make the server perform HTTP requests to arbitrary URLs. This may allow the attacker to access internal services or resources that are not publicly accessible, potentially leading to information disclosure. The impact is limited to confidentiality as per the CVSS vector, with no direct integrity or availability impact reported. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user access to trusted users only. Monitor for suspicious activity related to feed configuration or usage. Avoid exposing sensitive internal services that could be targeted via SSRF. Follow updates from the vendor themeisle for an official patch or mitigation instructions.