WPeMatico <=2.8.24 Authenticated Privilege Escalation via Arbitrary Option Update (CVE-2026-19883)

Vulnerability Overview Vulnerability Name: WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action CVE ID: CVE-2026-19883 CVSS Score: 8.8 (High) Release Date: August 21, 2026 Last Update Date: August 22, 2026 Researchers: Supakad S (m3z3r) - E-CURITY (Thailand) Impact Scope Affected Versions: WPeMatico RSS Feed Fetcher <= 2.8.24 Vulnerability Type: Privilege Escalation Vulnerability Description: The WPeMatico RSS Feed Fetcher plugin contains an unauthorized data modification vulnerability that may lead to privilege escalation. This vulnerability stems from a missing capability check within the function, affecting all versions up to 2.8.24. This allows authenticated attackers with Subscriber-level or higher privileges to update arbitrary options on the WordPress site, thereby escalating privileges to Administrator level and enabling user registration. Remediation Fixed Version: Update to 2.8.25 or higher Patch Version: 2.8.25 Additional Information Software Type: Plugin Software Slug: wpematico Fixed: Yes References: - plugins.trac.wordpress.org - github.com Recent Vulnerabilities Recent Vulnerability List: 1. WPeMatico RSS Feed Fetcher <= 2.8.17 - Unauthenticated Stored Cross-Site Scripting 2. WPeMatico RSS Feed Fetcher <= 2.8.12 - Authenticated (Editor) Stored Cross-Site Scripting 3. WPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber) Server-Side Request Forgery via wpematico_test_feed 4. WPeMatico RSS Feed Fetcher <= 2.8.10 - Authenticated (Subscriber) Sensitive Information Exposure 5. WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function 6. WPeMatico RSS Feed Fetcher <= 2.8.3 - Missing Authorization 7. WPeMatico RSS Feed Fetcher <= 2.6.11 - Admin Stored Cross-Site Scripting Notes Copyright Notice: This record contains copyrighted material provided by Defiant Inc. and MITRE Corporation. Contact Information**: Please contact wfi-support@wordfence.com for any errors or to add information. Summary The WPeMatico RSS Feed Fetcher plugin contains a privilege escalation vulnerability affecting versions <= 2.8.24. It is recommended to update to version 2.8.25 or higher to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WPeMatico <=2.8.24 Authenticated Privilege Escalation via Arbitrary Option Update (CVE-2026-19883)

More from this source