CVE-2026-8976

Authenticated attackers with contributor-level access can exploit this vulnerability. The plugin leaks a nonce, required for certain administrative actions, to users with the `edit_posts` capability via localized JavaScript. This allows attackers to bypass authorization checks and perform actions such as creating and executing RSS import jobs, purging posts, clearing error logs, and enumerating taxonomy terms and post meta keys without needing privileged nonce theft or a separate exploit step [ref_id=1].

The vulnerability lies within the plugin's handling of RSS import jobs and related administrative actions. Specifically, the localized script `feedzyjs` injects a nonce into the block editor, which is accessible to users with the `edit_posts` capability [ref_id=1]. This bypasses the intended authorization mechanisms for functions related to import job management and data manipulation.

The patch is not provided in the bundle. The advisory indicates that the vulnerability is due to the plugin not properly verifying user authorization for certain actions. Remediation guidance would typically involve implementing stricter authorization checks before allowing users to perform sensitive operations like creating imports, purging data, or accessing logs.