Description

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-22T03:16:20.833Z",
  "pubdate": "2026-08-22T03:16:20.833Z",
  "executiveSummary": "The WPeMatico RSS Feed Fetcher plugin for WordPress, in all versions up to and including 2.8.24, contains an unauthorized modification of data vulnerability that leads to privilege escalation. The security defect stems from a missing capability check on the wpematico_import_settings function. This vulnerability enables authenticated attackers holding subscriber-level access or higher to arbitrarily update WordPress site options. Successful exploitation of this flaw introduces significant risk to the integrity and confidentiality of the affected WordPress installation, as an attacker can manipulate core application settings without possessing administrative privileges. The primary exploitation requirement is authenticated access to the target WordPress instance, starting with the lowest possible subscriber privilege level. By weaponizing this capability, malicious actors can reconfigure critical site parameters such as default user registration roles and registration availability. Consequently, attackers can force newly registered accounts to be assigned administrative privileges, enabling them to completely compromise the underlying web application, execute arbitrary code via administrative plugins or themes, and fully control the affected system.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization check within the WPeMatico RSS Feed Fetcher plugin. Specifically, the vulnerable component is the wpematico_import_settings function, which fails to validate whether the invoking user possesses the appropriate administrative capabilities before processing data modification requests. This flaw exposes an insecure direct action vector accessible to any authenticated user, regardless of their assigned role.\nNetwork exposure of this vulnerability is identical to the standard WordPress application attack surface, requiring network-level access to the target HTTP or HTTPS endpoints handling WordPress AJAX, REST API, or administrative admin-post routines where the vulnerable function is registered or invoked. Authentication requirements are minimal, as the attack only requires a baseline authenticated session with subscriber-level privileges, which can typically be achieved through standard self-registration if enabled, or via compromised low-privilege accounts.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker with subscriber privileges crafts an HTTP request targeting the functionality governed by the wpematico_import_settings function. Because the function lacks a capability check (such as current_user_can), the application processes the incoming parameters without validating authorization. The attacker supplies malicious input intended to update arbitrary options within the WordPress wp_options database table. Specifically, the attacker targets global application settings such as users_can_register, setting it to true, and default_role, setting it to administrator.\nFollowing the successful execution of the wpematico_import_settings function, the post-exploitation impact is severe. With user registration enabled and the default registration role escalated to administrator, the attacker navigates to the public registration page and registers a new user account. Due to the manipulated default role option, WordPress automatically provisions this newly created account with administrative privileges. The attacker can then log in using the newly created administrative credentials, resulting in a full administrative takeover of the WordPress site. Affected versions include all iterations of the WPeMatico RSS Feed Fetcher plugin up to and including 2.8.24."
}