CVE-2026-8976 is an authorization bypass vulnerability (CWE-862) in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator WordPress plugin. Versions up to and including 5.1.7 are affected. The plugin fails to properly verify that a user is authorized to perform certain actions. Authenticated users with contributor-level access or higher can exploit this to create and execute RSS import jobs, purge posts associated with import jobs, clear import error logs, and enumerate taxonomy terms and post meta_key names. The nonce required for these actions is leaked via the feedzyjs localized script injected into the block editor, accessible to any user with edit_posts capability, removing the need for separate privilege escalation or nonce theft.

An attacker with contributor-level access or higher can bypass authorization controls to perform actions normally restricted to higher privileges. This includes creating and executing RSS import jobs, force-deleting posts associated with any import job, clearing import error logs, and enumerating taxonomy terms and post meta_key names. The vulnerability does not impact confidentiality or availability but allows unauthorized modification and deletion of content, which affects integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access carefully and monitor plugin updates from themeisle. Avoid granting edit_posts capability to untrusted users. No official fix or temporary workaround is currently documented.