CVE-2026-89001

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27

Description The plugin fails to verify if a user managing a feed campaign has the necessary permissions to publish content or attribute posts to other accounts. This allows users with contributor-level access or higher to publish posts live and assign any registered user, including administrators, as the post author.

Recommendations Update WPeMatico RSS Feed Fetcher to version 2.8.27 or later.