CVE-2026-19883

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.25

Description The plugin is susceptible to unauthorized data modification leading to privilege escalation. This occurs because the wpematico import settings() function lacks a proper capability check. Authenticated users with subscriber-level access or higher can exploit this to update arbitrary options on the WordPress site, such as changing the default registration role to administrator and enabling user registration to gain full administrative access.

Recommendations Update WPeMatico RSS Feed Fetcher to version 2.8.25 or later. As a temporary mitigation, restrict access to the wpematico import settings() function for users with low-level privileges.