The aggregator module fetches items from RSS feeds and makes them available on the site. The module provides an option to remove items from a particular feed. This has been implemented as a simple GET request and is therefore vulnerable to cross site request forgeries. For example: Should a privileged user view a page containing an <img> tag with a specially constructed src pointing to a remove items URL, the items would be removed.
Install the latest version:
If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade.
The Drupal security team.