CVE-2025-8103: WPeMatico RSS Feed Fetcher CSRF Flaw

CVE-2025-8103 Overview

CVE-2025-8103 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the WPeMatico RSS Feed Fetcher plugin for WordPress. The flaw affects all versions up to and including 2.8.7. The vulnerability exists in the handle_feedback_submission() function, which lacks nonce validation. Unauthenticated attackers can deactivate the plugin by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation removes RSS feed aggregation functionality from the target site, causing service disruption for content workflows that depend on the plugin.

Critical Impact
Unauthenticated attackers can force plugin deactivation on affected WordPress sites when an administrator is lured into clicking a malicious link, breaking automated RSS content aggregation.

Affected Products

WPeMatico RSS Feed Fetcher plugin for WordPress, versions up to and including 2.8.7
WordPress sites running the vulnerable plugin with administrator sessions active
Content aggregation workflows depending on WPeMatico feed processing

Discovery Timeline

2025-07-26 - CVE-2025-8103 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8103

Vulnerability Analysis

The vulnerability stems from missing CSRF protection in the plugin's feedback handling logic. WordPress provides a nonce (number used once) system to bind privileged state-changing requests to an authenticated session. The handle_feedback_submission() function in plugin_functions.php processes requests without calling wp_verify_nonce() or equivalent validation. As a result, the plugin accepts forged requests originating from any third-party origin as long as the target administrator has a valid WordPress session cookie. The exploit path leads to plugin deactivation, an availability impact rather than a confidentiality or integrity impact. User interaction is required because the attacker must convince the administrator to visit an attacker-controlled page or click a crafted link.

Root Cause

The root cause is the absence of nonce verification in handle_feedback_submission(). WordPress plugins performing state-changing operations must validate a nonce token generated with wp_create_nonce() and confirmed with check_admin_referer() or wp_verify_nonce(). Because the plugin trusts the presence of an authenticated session alone, any cross-origin request the browser sends with cookies is accepted as legitimate.

Attack Vector

An attacker crafts an HTML page or link that issues a request to the vulnerable endpoint on the target WordPress site. When a signed-in administrator loads the attacker's content, the browser automatically attaches the WordPress session cookie. The vulnerable handler processes the request and deactivates the WPeMatico plugin. No credentials, privileges, or prior access to the site are required. The attack is single-click and network-delivered.

No public proof-of-concept code is available. Technical details are documented in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-8103

Indicators of Compromise

Unexpected plugin deactivation events for WPeMatico in the WordPress wp_options table or admin activity logs
HTTP POST or GET requests to WPeMatico plugin endpoints referencing handle_feedback_submission with external or missing Referer headers
Administrator sessions immediately preceded by navigation to untrusted third-party domains
Site error logs showing RSS feed fetch jobs stopping abruptly after plugin state changes

Detection Strategies

Enable WordPress admin audit logging to record plugin activation and deactivation events with timestamps and initiating user
Inspect web server access logs for requests to WPeMatico URLs originating from cross-origin Referer values or lacking a nonce parameter
Correlate administrator browser activity with plugin state changes to identify likely CSRF-triggered actions

Monitoring Recommendations

Alert on any change to the WordPress active_plugins option outside a scheduled maintenance window
Monitor outbound links in administrator email and messaging channels for suspicious URLs targeting WordPress admin endpoints
Track HTTP requests to /wp-admin/ paths that lack expected _wpnonce query parameters

How to Mitigate CVE-2025-8103

Immediate Actions Required

Update the WPeMatico RSS Feed Fetcher plugin to a version above 2.8.7 that includes the nonce validation fix committed in WordPress Changeset 3333908
Instruct administrators to log out of WordPress sessions before browsing untrusted sites and to use separate browser profiles for administrative work
Review plugin activation logs for signs of unauthorized deactivation and reactivate WPeMatico if it was disabled without approval

Patch Information

The vendor addressed the vulnerability by adding nonce validation to the handle_feedback_submission() function. Refer to the WPematico Release Notes and the WordPress WPematico Developer Info page for the fixed version and upgrade instructions. Apply updates through the WordPress admin plugin manager or via WP-CLI.

Workarounds

Deactivate the WPeMatico plugin until the patched version is installed if the RSS aggregation feature is not business-critical
Deploy a Web Application Firewall (WAF) rule that blocks requests to WPeMatico admin endpoints missing a valid _wpnonce parameter
Restrict WordPress admin access with IP allowlisting or a VPN so cross-origin browser requests cannot reach admin URLs
Enforce the SameSite=Lax or SameSite=Strict attribute on WordPress session cookies to reduce cross-site request delivery

bash

# Update WPeMatico via WP-CLI to the patched version
wp plugin update wpematico

# Verify installed version
wp plugin get wpematico --field=version

# Temporarily deactivate the plugin if patching is delayed
wp plugin deactivate wpematico