Description
WordPress Plugin RSS Aggregator by Feedzy-Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. WordPress Plugin RSS Aggregator by Feedzy-Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator version 3.4.2 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.4.3 or latest
References
https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/
https://plugins.svn.wordpress.org/feedzy-rss-feeds/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Gmedia Photo Gallery Multiple Vulnerabilities (1.6.4)
WordPress Plugin WooCommerce Arbitrary File Download (3.4.5)
WordPress Plugin Newsletter Manager PHP Object Injection (1.5.1)
OpenSSL Numeric Errors Vulnerability (CVE-2007-4995)
WordPress Plugin Ad Inserter-Ad Manager & AdSense Ads Remote Code Execution (2.4.21)