RSS Aggregator by Feedzy Vulnerability – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator – Authenticated Blind Server-Side Request Forgery (SSRF) – CVE-2023-6805 | WordPress Plugin Vulnerability Report

Plugin Name: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Key Information:

  • Software Type: Plugin
  • Software Slug: feedzy-rss-feeds
  • Software Status: Active
  • Software Author: themeisle
  • Software Downloads: 2,223,288
  • Active Installs: 50,000
  • Last Updated: April 25, 2024
  • Patched Versions: 4.4.8
  • Affected Versions: <= 4.4.7

Vulnerability Details:

  • Name: RSS Aggregator by Feedzy <= 4.4.7
  • Title: Authenticated (Contributor+) Blind Server-Side Request Forgery (SSRF)
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2023-6805
  • CVSS Score: 6.4
  • Publicly Published: April 16, 2024
  • Researcher: Colin Xu
  • Description: The plugin is vulnerable to Blind Server-Side Request Forgery (SSRF) through the fetch_feed functionality. This vulnerability allows authenticated attackers, with contributor access and above, to initiate web requests to arbitrary locations originating from the server. This could be used to interact with or extract data from internal services that are otherwise inaccessible from the outside.


The RSS Aggregator by Feedzy plugin for WordPress contains a critical security vulnerability in versions up to and including 4.4.7, enabling contributors and higher to exploit blind SSRF vulnerabilities. The flaw was addressed progressively: version 4.4.7 patched the vulnerability for contributors, and version 4.4.8 extended this fix to authors.

Detailed Overview:

This SSRF vulnerability discovered by Colin Xu exposes web applications to potential unauthorized internal network interactions initiated by external users. SSRF attacks typically exploit the trust that a server has within its network or with other servers, allowing an attacker to force the server to make requests to unintended locations. In this case, authenticated users could manipulate the server into interacting with internal systems, potentially leading to information disclosure or internal system manipulation.

Advice for Users:

  • Immediate Action: Update the plugin to the latest version, 4.4.8, immediately to mitigate the SSRF vulnerability.
  • Check for Signs of Vulnerability: Monitor your server logs for any unexpected or anomalous outgoing requests that could indicate exploitation of this vulnerability.
  • Alternate Plugins: If looking for alternative RSS aggregation solutions, consider other highly rated plugins that maintain strong security records.
  • Stay Updated: Regularly updating your plugins and core WordPress installation is crucial for maintaining security and preventing exploitation.


The timely update of the RSS Aggregator by Feedzy plugin to correct a significant SSRF vulnerability illustrates the ongoing necessity of maintaining current versions of all software components. Users are advised to promptly install updates and continuously monitor for the release of patches to ensure the security and integrity of their WordPress installations. Staying informed and proactive in updating software not only prevents potential breaches but also safeguards the functionality and trustworthiness of your website.


Detailed Report:

In the ever-evolving digital landscape, the security of websites remains a paramount concern, particularly for platforms built on popular content management systems like WordPress. A recent vulnerability discovered in the "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator" plugin starkly highlights this issue. CVE-2023-6805, an authenticated Blind Server-Side Request Forgery (SSRF), was found to allow contributors and above to send web requests to arbitrary locations, potentially exposing internal networks to unauthorized access.

Risks and Potential Impacts

The ability of attackers to send requests to internal systems poses significant risks, including data breaches and potential network disruptions. For businesses, this could translate into financial loss, erosion of customer trust, and regulatory repercussions, especially if sensitive customer data were compromised.

Remediation Steps

  • Immediate Action: Users must update to version 4.4.8 immediately, which addresses this SSRF vulnerability.
  • Monitor Activity: Check server logs for any unusual activity that might indicate the vulnerability was exploited.
  • Review Security Practices: Ensure that the principle of least privilege is applied in user roles and permissions to minimize potential impacts of similar vulnerabilities.
  • Stay Updated: Regularly apply updates for all software components to protect against known vulnerabilities.

Previous Vulnerabilities

Since September 16, 2020, the plugin has seen 9 reported vulnerabilities, emphasizing the need for ongoing vigilance and regular updates.


The prompt update of the RSS Aggregator by Feedzy plugin to correct significant SSRF vulnerability underscores the critical nature of timely updates in safeguarding against potential threats. For small business owners, managing a WordPress site can be challenging, but neglecting plugin updates increases the risk of security breaches. It is vital to stay informed about security updates and to implement them without delay. Regularly investing time in maintaining your site’s security can prevent major setbacks, safeguarding your business’s online presence and reputation.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

RSS Aggregator by Feedzy Vulnerability – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator – Authenticated Blind Server-Side Request Forgery (SSRF) – CVE-2023-6805 | WordPress Plugin Vulnerability Report FAQs

What is SSRF and why is it dangerous?

Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. This can allow the attacker to access or interact with internal services that are only accessible from the server’s network. SSRF can be used to bypass firewalls, exposing sensitive data and internal systems to unauthorized users, potentially leading to further exploits or data breaches.

Leave a Comment