CVE-2026-89000: WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with contributor-level access or higher can exploit it. The issue is relevant where untrusted or lower-privileged users can access and run plugin campaigns.
What does an attacker need to provide?
The attacker needs to supply a feed URL and trigger a campaign run. The plugin fetches that URL from the server without validating the destination.
What could an attacker access through the vulnerable server?
The server can be induced to request internal-only resources, and the attacker can read the responses returned by those requests.
How can I tell whether my site is affected?
Sites using WPeMatico RSS Feed Fetcher versions earlier than 2.8.27 are affected. Review whether contributor-level or higher accounts can create or run campaigns with user-supplied feed URLs.