WPeMatico RSS Feed Fetcher EUVD-2026-87894

Requires an authenticated WordPress account at contributor role or higher on a site running WPeMatico RSS Feed Fetcher before 2.8.27; the plugin's feed-fetch feature performs no capability check, so any such user can supply an arbitrary URL and have the server fetch and render it. Exploitation is limited by that authentication requirement (no anonymous access), and impact is confined to read-back of responses from internal hosts (confidentiality only) - there is no direct code execution or write/modify capability. Realistic risk hinges on whether the site permits open/low-trust contributor registration and on what internal services (e.g. cloud metadata endpoints, internal-only web apps) are reachable from the web server.

This is a low-to-moderate priority SSRF. All exploitation signals point away from urgency: EPSS is 0.13% (2nd percentile), SSVC scores Exploitation=none / Automatable=no / Technical Impact=partial, and it is not on CISA KEV. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N, 4.1) is network-reachable and low-complexity but requires authentication and yields only limited confidentiality with no integrity/availability impact. Public exploit code exists (WPScan) but that is a distinct signal from active exploitation - none is claimed. Note a conflict in the privilege metric: the description says exploitation needs only 'contributor-level access and above,' which is a low-privilege WordPress role, yet the vendor scored PR:H; PR:L is more defensible, which would raise the score to roughly 5.0. The S:C is justified because a low-priv contributor pivots the server to reach internal-only network resources outside the app's authorization scope. Overall: a real but bounded read-only SSRF, gated behind authenticated low-priv access, worth patching but not an emergency.

An attacker who has (or registers/obtains) a contributor account on the WordPress site invokes the plugin's feed-fetch function with a URL pointing at an internal host (e.g. http://169.254.169.254/ cloud metadata or an internal admin service) and reads the reflected response. Because the plugin performs no capability check before fetching and rendering the URL, the server acts as a proxy into otherwise unreachable internal networks. A public proof-of-concept is available via WPScan.