CVE-2026-89004

LowCVSS 2.7

Published: 24/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

3th percentile - higher than 3% of all known CVEs

Summary

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.

Risk Assessment

Unauthorized access to campaign configurations and logs may expose sensitive information and violate other users' privacy.

Recommendation

Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later.

Other vulnerabilities in WPeMatico RSS Feed Fetcher WordPress Plugin

CVE-2026-110252Medium
The WPeMatico RSS Feed Fetcher plugin for WordPress (versions up to and including 2.9) is vulnerable to Stored Cross-Site Scripting because it removes the wp_filter_post_kses filter before saving RSS feed content. An unauthenticated attacker who publishes or compromises an RSS feed subscribed to by an administrator can inject arbitrary scripts into imported posts.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS