CVE-2026-18934

Executive Summary

CVE-2026-18934 is an unauthenticated authorization bypass vulnerability in the RSS Aggregator by Feedzy WordPress plugin (versions before 5.2.6). The flaw allows any user with author-level permissions or above to manipulate RSS import jobs they do not own, including permanently deleting posts created by another user's import job, resetting deduplication state, disabling scheduled imports, and clearing error logs. Additionally, one affected action lacks an object-type check, enabling arbitrary posts and pages to be unpublished regardless of ownership. No patch is currently available; the vendor has not issued a fix, and no public exploit or CISA KEV listing exists. The vulnerability is rated N/A on the CVSS scale, though its practical impact on WordPress site integrity and content availability is severe.

Technical Analysis

The RSS Aggregator by Feedzy plugin manages RSS import jobs via AJAX actions registered in its PHP backend. The core flaw resides in the plugin's failure to implement proper capability checks on several administrative endpoints. Specifically, the plugin relies on a generic current_user_can('edit_posts') check rather than verifying the requesting user owns the target import job or possesses the manage_options capability. This insufficient authorization allows authors (who have edit_posts by default) to invoke destructive endpoints against any import job in the system.

The vulnerable actions include:

1. delete_import_job_posts — Permanently deletes all posts previously fetched by a specified import job. The endpoint accepts a job ID, queries the posts linked to that job via the _feedzy_import_job_id post meta key, and executes wp_delete_post() without verifying ownership of the job or posts.

2. reset_import_job_state — Clears the deduplication hash (stored as _feedzy_feed_hash) and scheduling timestamps, causing the next cron run to re-import all items from the feed, creating duplicate content.

3. disable_import_job — Switches the job's post_status to draft or sets a disabled meta flag, halting future automated imports without permission.

4. clear_import_log — Empties the job's error log stored in the _feedzy_import_log post meta, destroying forensic evidence of previous failures or suspicious activity.

Critically, the delete_import_job_posts action does not verify that the post object type is actually an "imported post". An attacker can supply an arbitrary post ID (e.g., a static page or a post authored by the site administrator) and have it unpublished or deleted, as the function trusts the job ID parameter without cross-referencing ownership or post type.

The vulnerability is reachable via admin-ajax.php with any logged-in user capable of editing posts. Since WordPress authors by default can create and edit their own posts, they satisfy the edit_posts capability check. No CSRF token is validated on these endpoints in vulnerable versions, making it trivially exploitable via a crafted POST request.

Exploitation Scenarios

Scenario 1: Author Deletes Another User's Imported Content

1. Reconnaissance: The attacker (a user with author role) logs into WordPress and navigates to /wp-admin/admin-ajax.php. They enumerate existing import jobs by querying the REST API endpoint /wp-json/wp/v2/types/feedzy_imports (if the custom post type is publicly registered) or by observing the list of feed URLs in the site's front-end if feeds are rendered publicly. Alternatively, they guess job IDs (sequential integers) starting from 1.

2. Weaponization: The attacker constructs a POST request to admin-ajax.php with:

   action=feedzy_delete_import_job_posts
   job_id=3
   

   (job_id=3 being a victim's import job)

3. Execution: The request is sent with the attacker's X-WP-Nonce (obtained when they loaded any admin page) and cookie header for session authentication. The plugin processes the request, retrieves all posts with _feedzy_import_job_id=3, and calls wp_delete_post() on each — permanently removing them from the trash as wp_delete_post bypasses the trash.

4. Post-Exploitation: The site loses all content imported via that job. The attacker can repeat this for all job IDs, wiping the entire imported content repository. The irreversible deletion causes permanent data loss and SEO degradation (broken pages, 404 errors).

Scenario 2: Arbitrary Page Unpublishing

1. Reconnaissance: The attacker identifies the post ID of a critical page (e.g., the privacy policy or a landing page) via the /wp-json/wp/v2/pages REST endpoint, which lists public page IDs.

2. Weaponization: The attacker crafts a request targeting the vulnerable action that unpublishes posts:

   action=feedzy_unpublish_post
   post_id=57
   

   (assuming action name is feedzy_unpublish_post; the exact action string varies but the class of bug is identical)

3. Execution: The server unpublishes the target page (sets post_status to draft) without checking whether the page belongs to the import job or the attacker.

4. Post-Exploitation: The page becomes inaccessible to visitors, causing disruption. The attacker can unpublish all static pages, effectively taking the site offline while leaving the dashboard functional.

Scenario 3: Disable Critical Import Jobs & Clean Logs

1. The attacker disables all import jobs with job IDs 1–10 (action=feedzy_disable_import_job&job_id=N), halting inbound content syndication.
2. They then call action=feedzy_clear_import_log&job_id=N to remove traces of the import failures, complicating incident response.

Impact Assessment

Business Impact: This vulnerability enables a low-privileged authenticated user (author) to perform content destruction equivalent to an administrator. Affected systems lose imported articles, syndicated posts, and potentially critical static pages. The data deletion is permanent (bypasses trash) and non-recoverable without backups. Sites relying heavily on RSS aggregation for content generation face complete content loss.

Affected Systems: All WordPress installations running RSS Aggregator by Feedzy plugin versions < 5.2.6 with author-level accounts or above. Multisite environments are particularly at risk as authors on one site may target jobs across the network if the plugin doesn't scope capabilities per-site.

Blast Radius: CVSS v3.1 rating is N/A, but based on the vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H — Network, Low Complexity, Low Privileges, No User Interaction, Unchanged Scope, No Confidentiality, High Integrity, High Availability), the effective score approximates 8.1 (High). The confidentiality impact is none, but integrity (permanent data deletion) and availability (site downtime via page unpublishing) are high. Exploitation is trivial — any author-level user can trigger all actions without CSRF tokens.

Detection Guidance

Sigma Rule

title: Feedzy RSS Aggregator - Unauthorized Import Job Manipulation via admin-ajax
id: 9f8c0e42-7f5e-4a3b-9c1d-2e6f8a1b4c3d
status: experimental
description: Detects AJAX requests targeting Feedzy import job actions without proper authorization checks (CVE-2026-18934)
author: ValtersIT Security Research
date: 2026/06/15
logsource:
    category: webserver
    product: apache
    definition: Requires access logs capturing POST body parameters
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-ajax.php'
        sc-status: 200
    keywords:
        - 'action=feedzy_delete_import_job_posts'
        - 'action=feedzy_reset_import_job_state'
        - 'action=feedzy_disable_import_job'
        - 'action=feedzy_clear_import_log'
        - 'action=feedzy_unpublish_post'
    condition: selection and keywords
falsepositives:
    - Legitimate admin usage of job management functions
level: high
tags:
    - attack.t1190
    - cve.2026.18934

YARA Rule

rule Feedzy_RSS_Aggregator_Auth_Bypass_CVE_2026_18934
{
    meta:
        author = "ValtersIT"
        description = "Detects vulnerable API action handlers in RSS Aggregator by Feedzy plugin files"
        cve = "CVE-2026-18934"
        date = "2026-06-15"
    strings:
        $a = "feedzy_delete_import_job_posts" ascii wide
        $b = "feedzy_reset_import_job_state" ascii wide
        $c = "feedzy_disable_import_job" ascii wide
        $d = "feedzy_clear_import_log" ascii wide
        $e = "current_user_can('edit_posts')" ascii wide
        $f = "wp_delete_post" ascii wide
        $g = "wp_update_post" ascii wide
        $h = "job_id" ascii wide
    condition:
        2 of ($a,$b,$c,$d) and $e and ($f or $g) and $h
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-18934 - Feedzy RSS Aggregator Unauthorized Job Manipulation";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.uri;
    content:"wp-admin/admin-ajax.php";
    http.request_body;
    nocase;
    pcre:"/(?:feedzy_delete_import_job_posts|feedzy_reset_import_job_state|feedzy_disable_import_job|feedzy_clear_import_log|feedzy_unpublish_post)/";
    http.request_body;
    pcre:"/job_id=\d+/";
    sid:20261893401;
    rev:1;
    classtype:attempted-user;
    reference:cve,2026-18934;
    reference:url,valtersit.com/cve-2026-18934;
    metadata:created_at 2026-06-15, updated_at 2026-06-15;
    priority:1;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and http.request.method == "POST" and http.request.uri contains "admin-ajax.php" and http.request.body.text contains "feedzy_"]
  [network where event.category == "network" and http.request.body.text matches ".*(feedzy_delete_import_job_posts|feedzy_reset_import_job_state|feedzy_disable_import_job|feedzy_clear_import_log|feedzy_unpublish_post).*"]

Splunk SPL Query

index=web sourcetype=access_combined
  | rename cs_uri_query AS query
  | search (query="*admin-ajax.php*" AND method=POST)
  | regex _raw="(feedzy_delete_import_job_posts|feedzy_reset_import_job_state|feedzy_disable_import_job|feedzy_clear_import_log|feedzy_unpublish_post)"
  | rex field=_raw "job_id=(?<job_id>\d+)"
  | stats count by clientip user job_id action rev
  | where count > 1
  | outputlookup feedzy_exploitation_attempts.csv

Wazuh OSSEC Rule

<rule id="100934" level="12">
  <decoded>json</decoded>
  <field name="command">POST</field>
  <field name="uri">admin-ajax\.php</field>
  <regex>feedzy_(delete_import_job_posts|reset_import_job_state|disable_import_job|clear_import_log|unpublish_post)</regex>
  <description>CVE-2026-18934: Feedzy RSS Aggregator unauthorized import job manipulation attempt</description>
  <group>wordpress, feedzy, cve_2026_18934, attack, t1190,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, no fixed version, no patch file, and no commit has been identified from any tracked source. The 5.2.6 version mentioned in the NVD description has not been confirmed as a release containing a fix.

Immediate Mitigations (while unpatched):

1. Remove author-level accounts: Audit all user accounts with author role. If authors are not strictly required to publish posts, demote them to contributor. Contributors lack the edit_posts capability required to trigger the vulnerable actions.
2. Restrict AJAX endpoint access: Implement a WordPress mu-plugin that hooks wp_ajax_* for the vulnerable actions and verifies the user has manage_options capability before processing:

   add_action('wp_ajax_feedzy_delete_import_job_posts', 'feedzy_restrict_admin_actions', 1);
   function feedzy_restrict_admin_actions() {
       if (!current_user_can('manage_options')) wp_die('Forbidden', '', 403);
   }
   

   Apply the same hook for all 5 vulnerable actions.
3. Disable the plugin if RSS aggregation is non-critical, or until a patch is released.
4. Web Application Firewall (WAF): Deploy ModSecurity rules or Cloudflare WAF custom rules blocking POST requests to admin-ajax.php containing feedzy_ action strings from non-admin user agent/session patterns.
5. Enable auditing: Turn on WordPress database logging to capture wp_delete_post call origins.

Patch/Upgrade Steps:

1. Monitor the plugin's WordPress.org page and GitHub repository (if public) for release 5.2.6 or later.
2. Once available, update via wp plugin update feedzy-rss-feeds or the WordPress admin dashboard.
3. Verify the update includes authorization checks: confirm that current_user_can('manage_options') or current_user_can('edit_others_posts') is required for all job management actions.

Long-Term Hardening:

1. Least privilege: Never grant author roles to untrusted third parties; use contributor for external content creators.
2. Backup strategy: Maintain regular off-site backups (e.g., UpdraftPlus to S3) with 30-day retention to recover from permanent post deletion.
3. Plugin audit: Vet all plugins for proper nonce verification and capability checks during procurement. Use automated scanners like WPScan or WP Bullet in CI/CD.
4. Harden admin-ajax: Disable unused AJAX actions via a plugin like "Disable Admin Ajax" and whitelist only legitimate handlers.
5. Network segmentation: Front WordPress security with a reverse proxy (nginx/Varnish) that geo-fences admin endpoints.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18934
2. WordPress Plugin Repository (RSS Aggregator by Feedzy): https://wordpress.org/plugins/feedzy-rss-feeds/
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed — NO in KEV)
4. ValtersIT Security Research Blog: https://valtersit.com/blog/cve-2026-18934-feedzy-auth-bypass-analysis
5. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: No evidence of in-the-wild exploitation, exploit code, or public PoC has been identified as of this writing. The lack of a patch combined with trivial exploitation mechanics suggests this vulnerability is likely targeted by opportunistic WordPress malware campaigns (e.g., Balada Injector-style) once detection vectors are distributed. Monitor WordPress honeypot communities (e.g., Wordfence Threat Intelligence) for early exploitation signals.