Threats Tagged 'cve-2026-8976'

CVE-2026-8976 is an authorization bypass vulnerability in the WordPress plugin RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator, affecting all versions up to 5. 1. 7. The plugin fails to properly verify user authorization, allowing authenticated users with contributor-level access or higher to perform unauthorized actions such as creating and executing RSS import jobs, force-deleting posts from any import job, clearing import error logs, and enumerating taxonomy terms and post meta_key names. The required nonce for these actions is exposed to users with edit_posts capability via a localized script, removing the need for additional exploit steps. The CVSS score is 4. 3 (medium severity), indicating limited impact on confidentiality but potential integrity concerns. No official patch or remediation guidance is currently available from the vendor. No known exploits are reported in the wild.