EUVD-2026-64207
GHSA-rhx5-89fh-523v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network AJAX endpoint requires only subscriber credentials (PR:L); arbitrary options write yields full admin takeover with high C/I/A and no scope change beyond WordPress.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
Articles & Coverage 1
AnalysisAI
Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum subscriber-level privileges - CVSS PR:L confirms unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity - network-accessible with low complexity, requiring only a subscriber-level credential, yielding full site compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a target WordPress site (or uses a previously compromised one), then sends a crafted authenticated AJAX POST request to the wpematico_import_settings handler, overwriting the WordPress options default_role to administrator and users_can_register to 1. The attacker immediately registers a second account, which WordPress automatically grants administrator privileges, yielding full wp-admin access and complete site control. |
| Remediation | Upgrade WPeMatico RSS Feed Fetcher to version 2.8.25 or later, which adds current_user_can('manage_options') capability enforcement across all previously unprotected AJAX handlers; the upstream fix is available at https://github.com/etruel/wpematico/commit/e297f41b49c6ec76635b006dff8a964a99a1ed24. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all subscriber accounts on affected WordPress installations and disable the WPeMatico RSS Feed Fetcher plugin immediately to prevent exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wpematico Rss Feed Fetcher
View allThe WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before ou
Stored/reflected Cross-Site Scripting in the WPeMatico RSS Feed Fetcher WordPress plugin (versions 2.8.17 and earlier) a
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today