# CVE-2026-19883: WPeMatico RSS Feed Fetcher privilege escalation via missing capability check

Source: https://junglewise.ai/threats/cve-2026-19883-wpematico-rss-feed-fetcher-privilege-escalation-via-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19883 · Severity: high · CVSS 8.8 · Published 2026-08-22

WPeMatico is a popular WordPress plugin that automatically imports and publishes content from RSS feeds. Due to missing authorization checks in its settings import function, any authenticated user with subscriber-level access or higher can modify critical WordPress settings without proper permission. An attacker can exploit this to change the default user registration role to administrator and enable user registration, allowing them to create an admin account and take over the WordPress site.

## Quick answers

**Is CVE-2026-19883 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19883 being exploited in the wild.

**How severe is CVE-2026-19883?** High severity, with a CVSS score of 8.8, published 22 August 2026.

**Which products and versions are affected?** Evonik WPeMatico RSS Feed Fetcher up to and including 2.8.24.

**Is there a fix for CVE-2026-19883?** A patch was published on 2026-08-15: Version 2.8.25 released with capability checks added Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19883 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19883?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a privilege escalation resulting from a missing capability check in the wpematico_import_settings function. The affected function allows modification of arbitrary WordPress options without verifying whether the authenticated user has the required administrative permissions. An authenticated attacker with subscriber-level access or above can invoke this function to modify options such as default_role and users_can_register, effectively bypassing access controls. By setting the default registration role to administrator and enabling user registration, the attacker can create new administrator accounts and gain full site access. The vulnerability was patched in version 2.8.25 (released August 15, 2026) by adding proper capability checks and input validation.

## Affected products

- Evonik WPeMatico RSS Feed Fetcher up to and including 2.8.24

## Timeline

- 2026-08-22: disclosed
- 2026-08-15: patched: Version 2.8.25 released with capability checks added

## References

- [https://github.com/etruel/wpematico/commit/e297f41b49c6ec76635b006dff8a964a99a1ed24](https://github.com/etruel/wpematico/commit/e297f41b49c6ec76635b006dff8a964a99a1ed24)
- [https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.23/app/tools_page.php](https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.23/app/tools_page.php)