CVE-2026-19883highCWE-269

CVE-2026-19883: fallo de gravedad alta en etruel WPeMatico RSS Feed Fetcher

WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WPeMatico RSS Feed Fetcher

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.7%
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
etruel · WPeMatico RSS Feed Fetcher
CVEs relacionadas — etruel WPeMatico RSS Feed Fetcher

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-57937MEDIUMWordPress WPeMatico RSS Feed Fetcher Plugin <= 2.8.10 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2026-110252MEDIUMWPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content ImportEPSS 0.3%CVE-2026-57349HIGHWordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-11917MEDIUMWPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feedEPSS 0.2%CVE-2025-49922MEDIUMWordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-8103MEDIUMWPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission FunctionEPSS 0.2%