Vulnerability · Published Sep 27, 2026 · Assigned by WPScan
CVE-2026-89000WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run
Medium 4.1
In plain English
A medium-severity server-side request forgery in WPeMatico RSS Feed Fetcher from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.2%top 93.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WPeMatico RSS Feed Fetcher | 0 – before 2.8.27 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/2622b685-d2a9-4bb5-aeef-3aa4ca7adcc4/ exploit, vdb-entry, technical-description