CVE-2026-18934 is an incorrect authorization vulnerability (CWE-863) in the RSS Aggregator by Feedzy WordPress plugin prior to version 5.2.6. The plugin fails to verify that the requesting user owns or is authorized to edit the import job specified in the request. As a result, users with author-level privileges or higher can perform unauthorized actions such as deleting posts created by other users' import jobs, resetting import job states, disabling import jobs, clearing error logs, and unpublishing arbitrary posts and pages without ownership verification. This vulnerability allows privilege escalation within the scope of author-level access and above.

An attacker with author-level access or higher can abuse this vulnerability to delete or unpublish content created by other users, disrupt import job operations by resetting or disabling them, and clear error logs, potentially impacting content integrity and site operations. The vulnerability does not allow remote unauthenticated exploitation but enables privilege abuse within authorized user roles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and monitor for suspicious activity related to import job management. Avoid granting author-level permissions to untrusted users.