This IDOR vulnerability in the Feedzy RSS Feeds plugin allows any author-level user to unpublish arbitrary posts and pages on a WordPress site. The CVSS 5.5 score is misleading because the real danger isn't technical sophistication—it's the missing object-type check on the unpublish action. Unlike a typical IDOR where an attacker manipulates an identifier they already access, this endpoint accepts arbitrary object references without verifying ownership, object type, or capability. That's not a subtle logic flaw; it's an authorization gate that was never implemented.
WordPress's current_user_can() exists precisely to prevent this, and its absence is a genetic marker of the same vulnerability class that has produced dozens of WordPress plugin auth bypasses. This looks like an admin AJAX action built for internal tooling where developers added nonce checks to satisfy reviewers, then skipped object-type verification because the code path was 'only called by our own UI.'
The deployment assumptions matter here. Feedzy's market is content automation—RSS-to-post pipelines running with minimal human oversight. But the attack surface isn't the unmanned import jobs; it's the human operators who maintain them. When automation breaks, editors and coordinators log in with author or editor access to debug the pipeline. Those elevated accounts are the real target—one compromised author credential becomes a surgical demolition kit against any other author's published work.
The persistence risk compounds the impact. Import jobs run on cron schedules, regenerating content. An attacker can repeatedly unpublish whatever appears and force the site into an oscillating published/dark state while the admin chases a phantom bug. That's a denial-of-service vector that operates below the noise floor of standard WordPress monitoring, and the attacker holds it open indefinitely at negligible cost.
The trust model is fundamentally broken: author-level access on a Feedzy site was never intended to gate cross-object mutations across the entire content inventory. The fix isn't just adding ownership checks to this endpoint—it's recognizing that the entire permission model needs re-examination.