CVE-2024-1092: 
WordPress vulnerability analysis and mitigation

The RSS Aggregator by Feedzy WordPress plugin (versions up to 4.4.1) contains a vulnerability identified as CVE-2024-1092. The vulnerability was discovered and disclosed in February 2024, affecting the plugin's dashboard functionality. This security issue stems from a missing capability check that impacts the feedzy dashboard component (NVD).

The vulnerability is classified as a missing authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium). The security flaw manifests as an unauthorized data modification vulnerability due to insufficient capability checks in the feedzy dashboard. This allows authenticated users with contributor-level access or higher to perform unauthorized actions (Wordfence).

The vulnerability enables authenticated attackers with contributor access or higher to create, edit, or delete feed categories that were created by them, potentially leading to unauthorized data manipulation within the WordPress installation (NVD).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low, requiring network access and low privileges to execute (Wordfence).

Users should update their RSS Aggregator by Feedzy plugin to a version newer than 4.4.1. A patch has been released to address the missing capability check issue (WordPress).