CVE-2026-19883
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
The WPeMatico RSS Feed Fetcher plugin for WordPress up to version 2.8.24 is vulnerable to unauthorized data modification due to a missing capability check in the wpematico_import_settings function. Authenticated attackers with subscriber-level access or above can update arbitrary options on the WordPress site, potentially leading to privilege escalation.
Risk Assessment
Attackers can change the default registration role to administrator and enable user registration, allowing them to gain administrative access to the site.
Recommendation
Update the plugin to the latest available version that includes a security fix.
Other vulnerabilities in WPeMatico RSS Feed Fetcher
See all- CVE-2026-89006Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-89003Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response. This allows users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.
- CVE-2026-89001Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account. This allows users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author.
- CVE-2026-89000Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side. This allows users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
- CVE-2026-89005Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
- CVE-2026-89002Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
- CVE-2026-57349High
The WPeMatico RSS Feed Fetcher plugin versions up to 2.8.17 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can inject malicious script without authentication.
- CVE-2025-13031Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
- CVE-2025-11917Medium
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.11 via the wpematico_test_feed() function. This allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the web application, potentially querying and modifying information from internal services.
- CVE-2025-49922Medium
The WPeMatico RSS Feed Fetcher plugin by etruel is vulnerable to Missing Authorization in versions from n/a through 2.8.3. This issue allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS