What is the CVSS score of CVE-2026-19883?

CVE-2026-19883 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-19883?

Yes, a public proof-of-concept exploit is available for CVE-2026-19883. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-19883?

Within 24 hours: audit all subscriber accounts on affected WordPress installations and disable the WPeMatico RSS Feed Fetcher plugin immediately to prevent exploitation. Within 7 days: disable WordPress user registration site-wide or implement strict administrator approval for new accounts; audit all WordPress user roles and site options to identify any unauthorized administrative accounts created through exploitation; implement Web Application Firewall rules to monitor and block access to the wpematico_import_settings function. Within 30 days: monitor vendor communications and security bulletins for WPeMatico patch availability and test any release in a staging environment before production deployment; evaluate and migrate to alternative RSS feed management solutions with verified capability checks; implement multi-factor authentication for all administrative accounts; conduct comprehensive security audit of subscriber account privileges and access patterns.

WPeMatico RSS Feed Fetcher CVE-2026-19883

EUVD-2026-64207 HIGH

Improper Privilege Management (CWE-269)

2026-08-22 Wordfence

GHSA-rhx5-89fh-523v

WordPress Privilege Escalation Wordpress Plugin Wpematico Rss Feed Fetcher Etruel

8.8

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain subscriber-level WordPress account
Delivery

Send authenticated AJAX POST to wpematico_import_settings
Exploit

Overwrite default_role and users_can_register site options
Execution

Register new user account
Persist

Receive automatic administrator role
Impact

Achieve full WordPress admin control

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated WordPress session with at minimum subscriber-level privileges - CVSS PR:L confirms unauthenticated exploitation is not possible. The WPeMatico RSS Feed Fetcher plugin must be installed and active on the target site at version 2.8.24 or earlier. The full two-stage privilege escalation (options manipulation followed by admin account self-registration) additionally requires that WordPress user registration be enabled, or that the attacker already possesses a subscriber account obtained through other means. Sites with user registration disabled limit the attack's completion path, but the underlying arbitrary options write remains exploitable by any existing authenticated subscriber, meaning option tampering short of admin account creation (such as altering feed settings or other plugin options) is still possible regardless of registration state.
Impact	The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity - network-accessible with low complexity, requiring only a subscriber-level credential, yielding full site compromise. Real-world risk is highest on WordPress sites with open user registration, where an anonymous actor can self-register a subscriber account and immediately escalate; on sites with registration disabled, an attacker must already possess a subscriber account. No EPSS data was provided in the input and the vulnerability does not appear in CISA KEV, meaning no active exploitation campaigns have been confirmed at time of analysis. Despite the lack of observed exploitation, the attack is highly automatable - the entire chain from subscriber login to admin account creation can be scripted in two HTTP requests - which elevates practical risk above what KEV absence alone might suggest. No conflicting signals exist between CVSS metrics and the described behavior.
Exploit ScenarioDerived	An attacker registers a free subscriber account on a target WordPress site (or uses a previously compromised one), then sends a crafted authenticated AJAX POST request to the wpematico_import_settings handler, overwriting the WordPress options default_role to administrator and users_can_register to 1. The attacker immediately registers a second account, which WordPress automatically grants administrator privileges, yielding full wp-admin access and complete site control.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

1 public PoC No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 22, 2026

Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack chain is low-complexity and directly actionable by any authenticated user.

RemediationAI

Upgrade WPeMatico RSS Feed Fetcher to version 2.8.25 or later, which adds current_user_can('manage_options') capability enforcement across all previously unprotected AJAX handlers; the upstream fix is available at https://github.com/etruel/wpematico/commit/e297f41b49c6ec76635b006dff8a964a99a1ed24. If immediate patching is not feasible, disable user registration on the WordPress site via Settings > General by unchecking 'Anyone can register' - this breaks the second stage of the attack chain (registering the admin account) but does not eliminate the underlying options-write flaw, which any existing subscriber can still exploit. As an additional control, audit all existing WordPress user accounts at subscriber level for signs of unauthorized access and review recent changes to WordPress core options (particularly default_role and users_can_register) via the options table or a plugin such as Simple History.

Affected VersionsENISA

WPeMatico RSS Feed Fetcher 0 ≤2.8.24

Affected Packages

euvd wpematico_rss_feed_fetcher no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability class is CWE-269 (Improper Privilege Management), specifically the absence of a current_user_can('manage_options') capability check on the wpematico_import_settings AJAX handler registered in app/wpematico_functions.php. WordPress plugins commonly register AJAX hooks via wp_ajax_* actions; when these handlers lack capability enforcement, any authenticated user - including the lowest-privilege subscriber role - can invoke them directly. The affected code at wpematico_functions.php:L2077 and L2096 processed arbitrary settings imports without verifying caller privilege. The upstream fix (commit e297f41b) adds current_user_can('manage_options') guards across four files: wpematico_functions.php, settings_page.php, tools_page.php, and debug_page.php, confirming how broadly unprotected AJAX surface existed in versions through 2.8.24. The affected product is identified by CPE cpe:2.3:a:etruel:wpematico_rss_feed_fetcher:*:*:*:*:*:*:*:*.

Know when Wpematico Rss Feed Fetcher gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network AJAX endpoint requires only subscriber credentials (PR:L); arbitrary options write yields full admin takeover with high C/I/A and no scope change beyond WordPress.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High, 3 With POC Aug 22, 2026

Latest POC

1 public PoC link from github

Executive ViewAI

Why It Matters

WPeMatico RSS Feed Fetcher plugin (all versions through 2.8.24) creates a direct escalation path from subscriber access to full site administrator control, establishing a critical security risk for any WordPress deployment with user accounts. Affected organizations face potential data breaches, unauthorized administrative access, and operational compromise with no vendor patch available. Immediate action is required to mitigate this exposure.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Immediate mitigations: disable WPeMatico RSS Feed Fetcher plugin to eliminate attack vector; disable WordPress user registration or restrict new registrations to administrator approval only; implement granular role-based access controls limiting subscriber permissions; monitor WordPress error logs and admin action logs for unauthorized access patterns; maintain current backups enabling rapid restoration if compromise detected; restrict WordPress admin panel access by source IP address if operationally feasible.

Threat Intelligence Overview

EPSS Score

0.4%

Top 70% exploitable

Prevalence

Medium

WordPress RSS feed aggregation plugin, moderate install base

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.