Insufficient Validation in WPeMatico RSS Feed Fetcher Plugin by WordPress
CVE-2026-89000
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-89000?
The WPeMatico RSS Feed Fetcher plugin, prior to version 2.8.27, lacks proper capability checks and does not validate the destination of user-supplied feed URLs. This oversight permits users with contributor-level access or higher to generate server-side requests to internal-only resources, potentially exposing sensitive information from responses. Such vulnerabilities can lead to exploitation where unauthorized data access occurs, presenting a significant security risk for affected WordPress installations.
Affected Version(s)
WPeMatico RSS Feed Fetcher 0 < 2.8.27
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.