CVE-2026-89001 WPeMatico CVE debrief

Who should care

Defenders and administrators of WordPress sites using the WPeMatico RSS Feed Fetcher plugin should verify and limit user permissions to prevent unauthorized post publication and authorship attribution.

Why it matters

The WPeMatico RSS Feed Fetcher WordPress plugin vulnerability allows users with contributor-level access to publish posts live and set any registered user, including an administrator, as the post author, potentially leading to unauthorized post publication and impersonation of administrators.

• Potential unauthorized post publication by users with contributor-level access
• Potential impersonation of administrators through post authorship attribution

Technical summary

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author. This vulnerability could lead to unauthorized post publication and impersonation of administrators. The issue arises from insufficient permission checks for users running feed campaigns, which can be exploited by users with contributor-level access and above.

Defensive priority

Defenders should prioritize verifying and limiting user permissions for the WPeMatico RSS Feed Fetcher WordPress plugin, especially for users with contributor-level access and above.

Recommended defensive actions

• Verify and limit user permissions for the WPeMatico RSS Feed Fetcher WordPress plugin
• Update the WPeMatico RSS Feed Fetcher WordPress plugin to version 2.8.27 or later
• Monitor user activity and post authorship for suspicious behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 is vulnerable due to insufficient permission checks for users running feed campaigns. Evidence is based on CVE and NVD data, which may have limitations in scope and detail. Defenders should verify the vulnerability's impact on their systems and review user permissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.