Is CVE-2023-6805 actively exploited?

No active exploitation of CVE-2023-6805 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-6805 be exploited remotely?

Yes. CVE-2023-6805 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-6805?

CVE-2023-6805 has a CVSS score of 6.4 (MEDIUM).

HOME VULNERABILITIESCVE-2023-6805

MEDIUM

CVE-2023-6805

CWE-918Published: April 17, 2024· Updated: Jun 17, 2026

6.4

CVSS v3.1

Official Description

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to modify information from internal services. NOTE: This vulnerability, exploitable by contributor-level users, was was fixed in version 4.4.7. The same vulnerability was fixed for author-level users in version 4.4.8.

NVD Source

Technical Analysis

CVE-2023-6805 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.