CVE-2025-8103: WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to missing nonce validation in the handlefeedbacksubmission() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WPeMatico RSS Feed Fetcherto a version that resolves this vulnerability.Fixed in 2.8.7 - Configuration
Modify the handle_feedback_submission() function to include nonce validation (missing nonce validation is the cause) so that forged CSRF requests cannot deactivate the plugin.
WordPress plugin: WPeMatico RSS Feed Fetcher handle_feedback_submission() nonce validation = Enable nonce validation in handle_feedback_submission() to prevent CSRF
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8103?
CVE-2025-8103 is classified as a high-severity vulnerability due to the potential for unauthenticated attackers to exploit Cross-Site Request Forgery.
How do I fix CVE-2025-8103?
To fix CVE-2025-8103, update the WPeMatico RSS Feed Fetcher plugin to version 2.8.8 or later where nonce validation has been implemented.
What versions are affected by CVE-2025-8103?
CVE-2025-8103 affects all versions of the WPeMatico RSS Feed Fetcher plugin up to and including version 2.8.7.
What is Cross-Site Request Forgery in the context of CVE-2025-8103?
In the context of CVE-2025-8103, Cross-Site Request Forgery allows attackers to perform actions on behalf of users without their consent due to missing security checks.
Who is impacted by CVE-2025-8103?
Users of the WPeMatico RSS Feed Fetcher plugin for WordPress who have not updated to version 2.8.8 or later are at risk from CVE-2025-8103.