Unauthorized Data Modification in WPeMatico RSS Feed Fetcher Plugin by WordPress

CVE-2026-19883

What is CVE-2026-19883?

The WPeMatico RSS Feed Fetcher plugin for WordPress is flawed due to a missing capability check on the function responsible for importing settings. This vulnerability permits authenticated users with at least subscriber-level access to alter site settings. Consequently, attackers can exploit this issue to alter the default registration role, enabling unauthorized user registration and potentially gaining administrative access to the site.

References