CVE-2026-89001
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account. This allows users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author.
Risk Assessment
Unauthorized content publishing and post authorship spoofing can lead to disinformation and impersonation of an administrator.
Recommendation
Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.27 or later. Consider restricting permissions to run feed campaigns.
Other vulnerabilities in WPeMatico RSS Feed Fetcher
See all- CVE-2026-57349High
The WPeMatico RSS Feed Fetcher plugin versions up to 2.8.17 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can inject malicious script without authentication.
- CVE-2026-89006Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-89003Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response. This allows users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.
- CVE-2026-89000Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side. This allows users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
- CVE-2026-89005Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
- CVE-2026-89002Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
- CVE-2026-19883High
The WPeMatico RSS Feed Fetcher plugin for WordPress up to version 2.8.24 is vulnerable to unauthorized data modification due to a missing capability check in the wpematico_import_settings function. Authenticated attackers with subscriber-level access or above can update arbitrary options on the WordPress site, potentially leading to privilege escalation.
- CVE-2025-13031Medium
The WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
- CVE-2025-57937Medium
The WPeMatico RSS Feed Fetcher plugin by etruel is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This issue affects WPeMatico RSS Feed Fetcher versions from n/a through 2.8.10 and allows retrieval of embedded sensitive data.
Original NVD description (English source)
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS