CVE-2026-89001 — WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings

CVE-2026-89001

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings PUBLISHED

Description (CNA)

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author.

Affected (CNA)

Vendor / product	Versions
Unknown / WPeMatico RSS Feed Fetcher	affected 0 before 2.8.27

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/829bfdc3-7a15-4d6a-9782-72d34fd114b7/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.