CVE-2026-89003

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27

Description The plugin fails to perform a capability check before fetching a user-supplied URL and rendering the response. This allows users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back, a technique known as Server-Side Request Forgery (SSRF), where an attacker induces the server-side application to make requests to an unintended location.

Recommendations Update WPeMatico RSS Feed Fetcher to version 2.8.27 or later.