Server-Side Request Forgery Vulnerability in WPeMatico RSS Feed Fetcher Plugin for WordPress

CVE-2025-11917

What is CVE-2025-11917?

The WPeMatico RSS Feed Fetcher plugin for WordPress contains a Server-Side Request Forgery vulnerability that affects all versions up to and including 2.8.11. This flaw allows authenticated users with Subscriber-level access or higher to initiate unauthorized web requests from the WordPress application. Such actions can lead to the exposure of sensitive internal services, enabling attackers to manipulate or extract confidential information from these resources.

References