CVE-2026-89004

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.26

Description The plugin fails to verify ownership or authorization before returning a campaign's stored configuration and run log. This allows users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators, through an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input.

Recommendations Update to version 2.8.26 or later.