CVE-2024-1318: Unauthorized data modification vulnerability in the Feedzy WordPress plugin. This flaw allows contributors to bypass restrictions and publish arbitrary content.

CVE-2024-1318 affects the RSS Aggregator by Feedzy WordPress plugin, versions 4.4.2 and earlier. A missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions enables authenticated attackers with Contributor access or higher to draft and publish posts containing any content they choose, effectively escalating their privileges within the WordPress site. This vulnerability (CWE-862) poses a significant risk of unauthorized content injection and potential compromise of website integrity. While the CVSS score is 0, SOCRadar's Vulnerability Risk Score (SVRS) is 30, indicating a moderate risk that should be addressed, though not with the urgency of a critical vulnerability (SVRS > 80). Given this is tagged as 'In The Wild', the exploit is likely already in use, underscoring the need for patching. Patching to a later version is the best mitigation to secure the plugin.