CVE-2026-89000

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27

Description The plugin fails to perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side. This allows users with contributor-level access and above to induce the server to make requests to internal-only resources and read the responses back, a behavior known as Server-Side Request Forgery (SSRF).

Recommendations Update WPeMatico RSS Feed Fetcher to version 2.8.27 or later.