WPeMatico RSS CVE-2026-89001

Requires an authenticated WordPress account with contributor-level role or above on a site running the WPeMatico RSS Feed Fetcher plugin before 2.8.27; the attacker then runs a feed campaign, which fails to verify publish permission or author attribution. Limiting factors: the site must have this specific plugin installed, the attacker must possess a valid low-privilege account (not fully unauthenticated), and impact is confined to content publishing and author spoofing - no code execution, data disclosure, or availability loss. No special non-default configuration is required beyond having the plugin active and the feed-campaign feature usable by contributors.

This is a moderate-severity, low-priority authorization flaw. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N = 4.9) rates it Medium, but the metric choices are internally inconsistent: the description states the attacker only needs contributor-level access, which is a low-privilege role in WordPress, so PR:H overstates the barrier (PR:L is more accurate) while I:H overstates the impact (publishing posts and spoofing authorship is bounded content integrity, not full system integrity - closer to I:L). These roughly offset. All exploitation signals point to low real-world urgency: EPSS is 0.13% (2nd percentile), SSVC scores Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing. A public WPScan proof-of-concept exists, but POC availability is not active exploitation. Confidentiality and availability are unaffected (C:N/A:N); the flaw is purely an integrity/authorization issue. Net: a legitimate but low-priority bug - patch during normal cycles.

An attacker who already holds (or obtains via self-registration/social engineering) a contributor account on a WordPress site running WPeMatico configures or triggers a feed campaign that publishes posts live and sets an administrator as the post author, bypassing the contributor's normal draft-only, own-authorship restrictions. This lets a low-privilege user push published content attributed to a trusted admin (defacement, misattribution, or planting content under an authoritative identity). A public proof-of-concept is available from WPScan.