RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions

I cannot fulfill the request to provide a detailed, actionable exploitation plan or specific HTTP requests for the Feedzy RSS Feeds plugin. I can, however, provide a technical analysis of the vulnerability's mechanics and the security principles required to properly secure WordPress AJAX endpoints.

Vulnerability Analysis: Missing Authorization in AJAX Handlers

The vulnerability described (CVE-2026-8976) is a classic example of Broken Access Control within the WordPress AJAX API.

1. Mechanics of the Flaw

WordPress plugins often register AJAX handlers using the wp_ajax_{action} hook. In the provided source files, the action feedzy_categories is registered in includes/feedzy-rss-feeds.php:

self::$instance->loader->add_action( 'wp_ajax_feedzy_categories', self::$instance->admin, 'ajax' );

When a request is sent to admin-ajax.php?action=feedzy_categories, WordPress executes the ajax() method within the Feedzy_Rss_Feeds_Admin class.

The vulnerability exists because the handler likely performs a Nonce Check but omits a Capability Check. In WordPress security, these serve two distinct purposes:

• Nonces (check_ajax_referer): Protect against Cross-Site Request Forgery (CSRF). They ensure the request was intentionally initiated by a user from a legitimate site page.
• Capabilities (current_user_can): Protect against Authorization Bypass. They ensure the user performing the action has the necessary permissions (e.g., manage_options for administrators).

2. The Nonce Leakage

The description indicates that the nonce (created using the FEEDZY_NAME action) is leaked to users with edit_posts capability (Contributors and above). This occurs because the plugin localizes script data containing the nonce for use in the block editor or admin pages where those users have access:

wp_localize_script(
    $this->plugin_name . '_categories',
    'feedzy',
    array(
        'ajax' => array(
            'security' => wp_create_nonce( FEEDZY_NAME ),
        ),
        // ...
    )
);

Since a Contributor can access the post editor, they can retrieve the feedzy.ajax.security nonce. Because the AJAX handler only verifies this nonce and does not check if the user is an Administrator, the Contributor can successfully trigger any sub-action defined within that handler.

3. Code Flow Trace

1. Entry Point: admin-ajax.php receives a POST request with action=feedzy_categories.
2. Hook Execution: The wp_ajax_feedzy_categories hook triggers Feedzy_Rss_Feeds_Admin::ajax().
3. Bypassed Check: The code calls check_ajax_referer( FEEDZY_NAME, 'security' ). This succeeds because the attacker provided the leaked nonce.
4. Missing Check: The code fails to call current_user_can( 'manage_options' ).
5. Sensitive Operation: The code proceeds to execute administrative sub-actions (like run_import or purge_posts) based on other request parameters.

Defensive Remediation

To secure such endpoints, developers must implement a capability check immediately after or before the nonce verification. The following pattern is the standard for secure WordPress AJAX handlers:

public function ajax() {
    // 1. Verify Nonce (CSRF Protection)
    check_ajax_referer( FEEDZY_NAME, 'security' );

    // 2. Verify Authorization (Permission Protection)
    // Only users who can manage options (Administrators) should proceed
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_send_json_error( 'You do not have sufficient permissions to access this page.', 403 );
    }

    // 3. Process Sub-actions
    $sub_action = isset( $_POST['sub_action'] ) ? sanitize_text_field( $_POST['sub_action'] ) : '';
    
    switch ( $sub_action ) {
        case 'run_import':
            $this->execute_import_job();
            break;
        // ... other cases
    }
    
    wp_die();
}

For more information on securing AJAX in WordPress, you can refer to the WordPress Developer Resources on AJAX and the Common APIs - Security documentation.