WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action vulnerability

Authenticated Subscriber+ Privilege Escalation via Arbitrary Option Update to wpematicoimportsettings adminaction vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WPeMatico RSS Feed Fetcher versions = 2.8.24...

CVE-2026-19883: Improper Privilege Management

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...