CVE-2026-89004 in WPeMatico RSS Feed Fetcher Plugin
Summary
by MITRE • 09/24/2026
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in WPeMatico RSS Feed Fetcher versions prior to 2.8.26 represents a critical failure in server-side access control mechanisms within the WordPress ecosystem. This flaw specifically affects how the plugin handles requests for retrieving campaign configurations and execution logs via its REST API endpoints or AJAX handlers. The core technical deficiency lies in the absence of proper authorization checks that validate whether the requesting user is the legitimate owner of the specific resource being accessed. Instead of verifying ownership, the application logic appears to rely on insufficient validation methods, such as checking only for general administrative privileges or basic authentication tokens without cross-referencing them against the database records associated with each campaign ID. This architectural oversight allows any authenticated user possessing contributor-level access and above to bypass intended isolation boundaries between different users' data sets within a multi-site WordPress installation or even on single-user sites where multiple accounts exist.
From an operational perspective, this vulnerability enables unauthorized information disclosure that can lead to significant security compromises for the affected website owners. By exploiting this flaw, an attacker with low-privilege access can extract sensitive configuration details of campaigns created by other users, including those held by administrators. These configurations often contain API keys, authentication tokens, database credentials, or webhook URLs necessary for integrating external services such as social media platforms, email marketing tools, or cloud storage providers. The exposure of these secrets allows the attacker to potentially hijack automated workflows, inject malicious content into published posts via RSS feeds, or exfiltrate further sensitive data from connected third-party services. Furthermore, access to run logs may reveal internal server paths, error messages that expose stack traces, and timing information about when campaigns are executed, which aids in crafting more sophisticated attacks against the underlying infrastructure.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper restrictions on an authenticated user's actions regarding specific resources. It also maps directly to MITRE ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate credentials to gain access to systems and data that they should not be permitted to view. In the context of WordPress plugin development, this highlights a common pitfall in REST API implementation where developers assume that checking for general user roles is sufficient without implementing resource-level ownership verification. The lack of such checks creates an insecure direct object reference scenario where sequential or predictable campaign IDs can be iterated through by an attacker to enumerate and access data belonging to all other users on the platform.
To mitigate this risk, immediate action must be taken by upgrading the WPeMatico plugin to version 2.8.26 or later, which includes patches for these authorization checks. For organizations unable to upgrade immediately due to compatibility constraints with other plugins or custom code, implementing a web application firewall rule that restricts access to the specific API endpoints associated with campaign retrieval can provide temporary relief. Additionally, security audits should be conducted on all WordPress plugins in use to ensure they adhere to OWASP guidelines for secure coding practices, particularly regarding input validation and output encoding alongside strict authorization checks. Developers must enforce principle of least privilege by ensuring that every data access request verifies not only the user's role but also their explicit ownership or authorized relationship with the specific resource being requested.