# CVE-2026-89000: WPeMatico RSS Feed Fetcher SSRF in campaign run

Source: https://junglewise.ai/threats/cve-2026-89000-the-wpematico-rss-feed-fetcher-wordpress-plugin-before-2-8-27  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-89000 · Severity: info · Published 2026-09-27

The WPeMatico RSS Feed Fetcher WordPress plugin is used to aggregate RSS feeds on WordPress sites. Before version 2.8.27, a contributor-level user could exploit a server-side request forgery (SSRF) vulnerability to make the server request internal-only resources, potentially exposing sensitive data or interacting with internal services not accessible from the internet.

Technologies: [WPeMatico RSS Feed Fetcher](https://junglewise.ai/threats/technologies/wpematico-wpematico-rss-feed-fetcher). Vendors: [WPeMatico](https://junglewise.ai/threats/vendors/wpematico).

## Quick answers

**Is CVE-2026-89000 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89000 being exploited in the wild.

**How severe is CVE-2026-89000?** Informational severity, published 27 September 2026.

**Which products and versions are affected?** WPeMatico RSS Feed Fetcher before 2.8.27.

**Is there a fix for CVE-2026-89000?** A patch was published on 2026-09-27: Fixed in version 2.8.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89000 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89000?** Check whether you run WPeMatico RSS Feed Fetcher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to validate destination URLs or check user capabilities before fetching a user-supplied feed URL server-side. An attacker with contributor access (or higher) can craft a malicious feed URL pointing to internal resources, causing the server to make requests and return responses that reveal internal system information. The vulnerability is an SSRF (CWE-918) requiring authentication at the contributor level or above.

## Affected products

- WPeMatico WPeMatico RSS Feed Fetcher before 2.8.27

## Timeline

- 2026-09-25: disclosed
- 2026-09-27: patched: Fixed in version 2.8.27

## References

- [https://wpscan.com/vulnerability/2622b685-d2a9-4bb5-aeef-3aa4ca7adcc4/](https://wpscan.com/vulnerability/2622b685-d2a9-4bb5-aeef-3aa4ca7adcc4/)

## Related threats

- [WPeMatico RSS Feed Fetcher stored XSS in feed import](https://junglewise.ai/threats/cve-2026-89006-the-wpematico-rss-feed-fetcher-wordpress-plugin-before-2-8-27)
- [WPeMatico RSS Feed Fetcher SSRF in campaign preview](https://junglewise.ai/threats/cve-2026-89003-the-wpematico-rss-feed-fetcher-wordpress-plugin-before-2-8-27)
- [WPeMatico RSS Feed Fetcher privilege escalation in campaign settings](https://junglewise.ai/threats/cve-2026-89001-the-wpematico-rss-feed-fetcher-wordpress-plugin-before-2-8-27)