CVE-2026-19883
Received Received - Intake

Privilege Escalation in WPeMatico RSS Feed Fetcher Plugin

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: Wordfence

Description
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-19883
EUVD
EUVD-2026-64207

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
etruel wpematico to 2.8.24 (inc)
etruel wpematico 2.8.25

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WPeMatico RSS Feed Fetcher WordPress plugin up to version 2.8.24. It allows authenticated attackers with subscriber-level access or higher to modify WordPress site settings without proper authorization. The issue stems from a missing capability check in the wpematico_import_settings function, enabling privilege escalation. Attackers could update options to set the default registration role to administrator and enable user registration, granting them admin access.

Detection Guidance

Check if the WPeMatico plugin version is 2.8.24 or below. Log in as a subscriber or higher and attempt to modify settings via the wpematico_import_settings function. If settings changes are possible without admin privileges, the vulnerability may exist.

Impact Analysis

If you use the vulnerable WPeMatico plugin, attackers could gain administrative control of your WordPress site. This allows them to modify site settings, install malicious plugins, steal data, or deface your website. Even with minimal user access, attackers can escalate privileges to full admin rights, compromising the entire site.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguarding protected health information. A successful exploit may result in unauthorized data exposure, triggering legal penalties and reputational damage.

Mitigation Strategies

Update the WPeMatico plugin to version 2.8.25 or later. Review user roles and disable subscriber-level access if not required. Monitor for unauthorized admin role changes or user registrations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19883. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart