CVE-2026-89001: WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings
Published Sep 27, 2026
·Updated
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author.
Affected Software
1 affected component
WPeMatico WPeMatico RSS Feed Fetcher<2.8.27
Event History
Sep 27, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user with contributor-level access or higher can exploit it by running a feed campaign. The issue does not require unauthenticated access.
2
What actions can an attacker perform?
They can publish posts live even if they are not permitted to publish content. They can also assign the posts to any registered account, including an administrator account.
3
Which versions are affected?
WPeMatico RSS Feed Fetcher versions before 2.8.27 are affected.