CVE-2023-6798: 
WordPress vulnerability analysis and mitigation

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress contains a vulnerability (CVE-2023-6798) discovered in January 2024. The vulnerability affects all versions up to and including 4.3.2, and is characterized by a missing authorization check when updating settings (NVD).

The vulnerability stems from a missing capability check when updating settings, which includes proxy settings. It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (NVD, Wordfence).

The vulnerability allows authenticated attackers with author-level access or above to modify the plugin's settings, including proxy settings. This unauthorized access to settings configuration could potentially lead to security misconfigurations and compromise the intended functionality of the plugin (NVD).

The vulnerability requires an authenticated user with at least author-level privileges to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users are advised to update to version 4.3.3 or later of the RSS Aggregator by Feedzy plugin, which contains the fix for this vulnerability (NVD).