CVE-2026-19883

HighCVSS 8.8

Published: 22/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

The WPeMatico RSS Feed Fetcher plugin for WordPress up to version 2.8.24 is vulnerable to unauthorized data modification due to a missing capability check in the wpematico_import_settings function. Authenticated attackers with subscriber-level access or above can update arbitrary options on the WordPress site, potentially leading to privilege escalation.

Risk Assessment

Attackers can change the default registration role to administrator and enable user registration, allowing them to gain administrative access to the site.

Recommendation

Update the plugin to the latest available version that includes a security fix.

Other vulnerabilities in WPeMatico RSS Feed Fetcher

CVE-2026-57349High
The WPeMatico RSS Feed Fetcher plugin versions up to 2.8.17 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can inject malicious script without authentication.

Original NVD description (English source)

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.