CVE-2026-19883: WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/WPeMatico RSS Feed Fetcherto a version that resolves this vulnerability.Fixed in 2.8.24 - Configuration
Ensure wpematico_import_settings enforces an appropriate WordPress capability check before allowing arbitrary option updates; the vulnerability is present in all versions up to and including 2.8.24 due to a missing capability check.
WPeMatico RSS Feed Fetcher plugin wpematico_import_settings capability check = required - Operational
After patching, review and reset any changes attackers may have made to the WordPress default role for registration and to the user registration setting, since the issue can update default role to administrator and enable user registration.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the WordPress site with at least Subscriber-level access. No user interaction is required.
What site settings can an attacker change?
The vulnerable function permits authenticated low-privilege users to update arbitrary WordPress options. The described escalation path changes the default registration role to Administrator and enables user registration.
How could an attacker obtain administrator access?
A Subscriber or higher-privileged attacker can enable registration and set Administrator as the default role for newly registered users. They can then register an account with administrative access.
Which plugin versions are affected?
WPeMatico RSS Feed Fetcher versions up to and including 2.8.24 are affected. The provided data does not identify a fixed version.