CVE-2025-11467

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11467", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-07T20:51:21.871Z", "datePublished": "2025-12-11T01:55:32.407Z", "dateUpdated": "2026-04-08T16:54:19.734Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:19.734Z"}, "affected": [{"vendor": "themeisle", "product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5754dce7-6b47-4490-a04a-7eabfded0720?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.1.0/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L551"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}], "timeline": [{"time": "2025-10-02T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-07T21:09:10.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-10T12:23:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-11T15:34:23.524101Z", "id": "CVE-2025-11467", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T15:34:28.633Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11467", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-11T15:34:23.524101Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T15:34:26.447Z"}}], "cna": {"title": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "themeisle", "product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-07T21:09:10.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-10T12:23:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5754dce7-6b47-4490-a04a-7eabfded0720?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.1.0/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L551"}], "descriptions": [{"lang": "en", "value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:19.734Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11467", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:54:19.734Z", "dateReserved": "2025-10-07T20:51:21.871Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-11T01:55:32.407Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator", "vendor": "themeisle", "versions": [{"lessThanOrEqual": "5.1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin para WordPress RSS Aggregator by Feedzy - Agregador de Feeds de Publicaciones, Autoblogging, Noticias y Videos de YouTube es vulnerable a Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor Ciega en todas las versiones hasta la 5.1.1, inclusive, a trav\u00e9s de la funci\u00f3n feedzy_lazy_load. Esto permite a atacantes no autenticados realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-11467", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11467", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-11T15:34:23.524101Z", "version": "2.0.3"}}]}, "published": "2025-12-11T03:15:57.450", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.1.0/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L551"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5754dce7-6b47-4490-a04a-7eabfded0720?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:15:44.289664+00:00", "value": {"mitigation_remediation": ["Upgrade the RSS Aggregator by Feedzy plugin to a version that removes the blind SSRF flaw.", "If an update is not available, disable the plugin or restrict access to the feedzy_lazy_load function.", "Configure outbound network restrictions or use a web application firewall rule to block arbitrary HTTP requests originating from the plugin."], "summary": {"action": "Apply Patch", "impact": "Blind Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "This issue affects the Themeisle WordPress plugin RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator for all releases up to and including version 5.1.1. No other plugin versions are known to be vulnerable, but any installation of the affected versions that is still in use remains at risk.", "description_and_impact": "The RSS Aggregator by Feedzy plugin contains an unauthenticated blind server\u2011side request forgery (SSRF) vulnerability in the feedzy_lazy_load function. Attackers can cause the WordPress site to issue HTTP requests to arbitrary internal or external hosts, enabling the retrieval or modification of sensitive data from services that are normally inaccessible from the public internet. This flaw can expose internal network structure, exfiltrate confidential information, or allow malicious modification of internal resources.", "risk_and_exploitability": "With a CVSS score of 5.8 the vulnerability is considered moderate. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw allows unauthenticated actors to issue arbitrary requests from the host, it can be leveraged to probe internal services, exfiltrate information, or manipulate application data. The likely attack vector is an unauthenticated user sending a crafted request that triggers feedzy_lazy_load, which then forwards the request to a target host chosen by the attacker."}}}}, "created": "2025-12-11T16:20:05.340945+00:00", "updated": "2026-04-22T12:30:16.825535+00:00", "vendors": ["themeisle", "themeisle$PRODUCT$rss_aggregator_by_feedzy", "wordpress", "wordpress$PRODUCT$wordpress"]}