CVE-2024-1318: 
WordPress vulnerability analysis and mitigation

The RSS Aggregator by Feedzy plugin for WordPress (versions up to and including 4.4.2) contains a vulnerability identified as CVE-2024-1318. The vulnerability stems from a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions, which leads to unauthorized modification of data (NVD).

The vulnerability is classified with a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The security flaw is categorized as CWE-862 (Missing Authorization) and affects the plugin's capability checking mechanism (NVD).

The vulnerability allows authenticated attackers with Contributor access or higher to bypass normal restrictions. These users, who are typically limited to creating posts only, can exploit this flaw to draft and publish posts with arbitrary content (NVD).

The vulnerability requires authentication with at least Contributor-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users should update to version 4.4.3 or later of the RSS Aggregator by Feedzy plugin, which contains the security fix for this vulnerability (NVD).