CVE-2026-89000— WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run
Quick assessment
Affected
Unknown WPeMatico RSS Feed Fetcher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WPeMatico RSS Feed Fetcher WordPress 插件在 2.8.27 版本之前，在服务器端获取用户提供的 RSS 源 URL 之前，未执行权限检查或验证目标 URL 的安全性。这一缺陷允许具有“贡献者”（contributor）及以上权限的用户，诱导服务器向仅内部可访问的资源发起请求，并将响应内容读取回本地，从而可能导致内部信息泄露。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89000
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run
Source: CVE Program / CVE List V5
Vulnerability Description
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WPeMatico RSS Feed Fetcher | 0 ~ 2.8.27 | - |
|
II. Public POCs for CVE-2026-89000
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89000
请登录查看更多情报信息。
Other References for CVE-2026-89000 (1)
-
https://wpscan.com/vulnerability/2622b685-d2a9-4bb5-aeef-3aa4ca7adcc4/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-27 · 19 CVEs total
| CVE-2026-89003 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview | |
| CVE-2026-84069 | WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php | |
| CVE-2026-81655 | Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields | |
| CVE-2026-82841 | UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migrati | |
| CVE-2026-85002 | EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes | |
| CVE-2026-86609 | Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription | |
| CVE-2026-86839 | Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via I | |
| CVE-2026-86841 | Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced O | |
| CVE-2026-89001 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing vi | |
| CVE-2026-96899 | Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script | |
| CVE-2026-89006 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import | |
| CVE-2026-96896 | Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deleti | |
| CVE-2026-96897 | Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Passw | |
| CVE-2026-96895 | WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes | |
| CVE-2026-92995 | Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file | |
| CVE-2026-92436 | Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via I | |
| CVE-2026-97319 | PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block | |
| CVE-2026-97227 | NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential |
IV. Related Vulnerabilities
Same product: WPeMatico RSS Feed Fetcher
-
CVE-2026-89003
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via -
CVE-2026-89001
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publ -
CVE-2026-89006
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XS -
CVE-2026-89004
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign -
CVE-2026-89005
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XS
Same vendor: Unknown
-
CVE-2026-92996
Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via -
CVE-2026-89411
Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbo -
CVE-2026-86838
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking P -
CVE-2026-88828
Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked Us -
CVE-2026-84744
WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Sho
V. Comments for CVE-2026-89000
No comments yet