CVE-2025-8103mediumCWE-352

CVE-2025-8103: falha de média gravidade em etruel WPeMatico RSS Feed Fetcher

WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WPeMatico RSS Feed Fetcher

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.2%
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to missing nonce validation in the handle_feedback_submission() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Produtos afetados
etruel · WPeMatico RSS Feed Fetcher
CVEs relacionadas — etruel WPeMatico RSS Feed Fetcher

No mesmo produto, das mais perigosas para as menos.

CVE-2026-19883HIGHWPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_actionEPSS 0.7%CVE-2025-57937MEDIUMWordPress WPeMatico RSS Feed Fetcher Plugin <= 2.8.10 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2026-110252MEDIUMWPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content ImportEPSS 0.3%CVE-2026-57349HIGHWordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-11917MEDIUMWPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feedEPSS 0.2%CVE-2025-49922MEDIUMWordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.3 - Broken Access Control vulnerabilityEPSS 0.2%