WPeMatico EUVD-2026-87892

Requires an authenticated WordPress account with contributor-level role or higher on a site running WPeMatico RSS Feed Fetcher before 2.8.27; the attacker then supplies a feed URL that the plugin fetches server-side with no capability check or destination validation. Exploitation is limited by that authentication requirement (contributor role) and by impact being read-only disclosure of internal responses (no write/RCE). It is non-blind - the fetched response is returned to the attacker - which increases its usefulness for internal reconnaissance and metadata/credential retrieval.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N = 4.1) describes a network-reachable, low-complexity, scope-changing SSRF with only limited confidentiality impact and no integrity or availability effect. Multiple secondary signals reinforce the LOW real-world urgency: EPSS is just 0.13% (2nd percentile), the SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial', and there is no CISA KEV listing. The one signal that raises attention is that public exploit code exists (WPScan), but POC availability is distinct from active exploitation and none is claimed here. One notable conflict: the vendor sets PR:H, yet the description explicitly says the flaw is reachable by 'contributor-level access and above' - contributor is a low-privilege WordPress role, so PR:L is more defensible and would push the score to roughly 5.0. Even with that correction this remains a medium-severity, low-real-risk finding rather than a priority: it requires an authenticated foothold and yields only read access to internal responses.

An attacker who holds (or phishes/registers into) a contributor account on a WordPress site running WPeMatico before 2.8.27 supplies a feed URL pointing at an internal-only resource (e.g., a cloud metadata endpoint or an internal admin service). The plugin fetches it server-side without a capability or destination check and returns the response body, letting the attacker read internal data. Public exploit code exists (WPScan), lowering the effort, but the attacker must first have contributor-or-above access.