CVE-2025-11128 in RSS Aggregator Plugin
Summary
by MITRE • 10/23/2025
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2025
The vulnerability identified as CVE-2025-11128 affects the RSS Aggregator by Feedzy plugin for WordPress, specifically targeting versions up to and including 5.1.0. This represents a critical security flaw that enables authenticated attackers with subscriber-level privileges or higher to exploit a server-side request forgery vulnerability through the feedzy_sanitize_feeds function. The flaw resides within the plugin's handling of feed data processing, creating a pathway for malicious actors to initiate outbound network requests from the affected WordPress server.
The technical implementation of this vulnerability stems from insufficient input validation and sanitization within the feedzy_sanitize_feeds function which processes RSS feed data. When the plugin processes external feed sources, it fails to properly validate or restrict the URLs being accessed, allowing attackers to manipulate the feed processing logic to make arbitrary HTTP requests. This vulnerability falls under CWE-918, Server-Side Request Forgery, which specifically addresses situations where applications fail to properly validate user-supplied URLs or parameters that are used to make network requests.
The operational impact of this vulnerability extends beyond simple data exfiltration, as it enables attackers to probe internal network services that may be accessible from the web server hosting the WordPress installation. An attacker with subscriber access can leverage this flaw to map internal network topology, identify running services, and potentially access sensitive internal resources that would normally be protected by network segmentation. This capability significantly increases the attack surface and can lead to further compromise of the affected system.
Security professionals should note that this vulnerability represents a common pattern in web application security where input validation failures in content processing modules create opportunities for attackers to bypass normal network restrictions. The ATT&CK framework categorizes this as a technique for "T1071.004 - Application Layer Protocol: DNS" and "T1046 - Network Service Scanning" when exploited for internal reconnaissance. Organizations should immediately implement mitigation strategies including plugin version updates, network segmentation, and implementing web application firewalls to block suspicious outbound requests.
Mitigation efforts should prioritize immediate plugin updates to versions that address this vulnerability, while also implementing network-level controls to restrict outbound requests from the WordPress server. The principle of least privilege should be enforced by limiting the plugin's capabilities to only necessary feed processing functions. Additionally, monitoring for unusual outbound network activity and implementing proper input validation for all feed data processing should be part of the remediation strategy. Organizations should also consider implementing network access controls that prevent the WordPress server from accessing internal services that are not explicitly required for the plugin's functionality.