CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
What the vulnerability does
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
The RSS Aggregator by Feedzy plugin for WordPress contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the site send HTTP requests to internal or external systems on the attacker's behalf. An attacker can read responses from those requests, potentially exposing sensitive data or internal services. No user interaction is required.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs and read the responses.
Potential impact on your site
Attackers can probe your internal network, access internal services, or exfiltrate data without logging in.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
