PT-2025-45087
CVE-2025-11917
·
Published
2025-11-04
·
Updated
2026-10-18
Description by
CVSS 3.1
6.4
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
WPeMatico RSS Feed Fetcher versions up to and including 2.8.11
Description
The WPeMatico RSS Feed Fetcher plugin for WordPress is susceptible to Server-Side Request Forgery via the
wpematico test feed() function. Authenticated attackers with Subscriber-level access or higher can leverage this to make web requests to arbitrary locations from the web application, potentially allowing them to query and modify information from internal services.Recommendations
Update WPeMatico RSS Feed Fetcher to a version later than 2.8.11.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾