CVE-2026-89003: WPeMatico WordPress Plugin SSRF Vulnerability

CVE-2026-89003 Overview

CVE-2026-89003 is a Server-Side Request Forgery (SSRF) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.27. The plugin fails to perform a capability check before fetching a user-supplied URL and rendering the response. Authenticated users with contributor-level access or above can force the server to issue HTTP requests to internal-only hosts and read the responses. The flaw is tracked as CWE-918: Server-Side Request Forgery.

Critical Impact
Contributor-level accounts can pivot the WordPress server to probe internal network resources and exfiltrate response content from otherwise unreachable hosts.

Affected Products

WPeMatico RSS Feed Fetcher WordPress plugin versions prior to 2.8.27
WordPress sites allowing contributor-level registrations with the plugin installed
Multisite WordPress deployments with the plugin network-activated

Discovery Timeline

2026-09-27 - CVE-2026-89003 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-89003

Vulnerability Analysis

The WPeMatico RSS Feed Fetcher plugin exposes functionality that accepts a URL from an authenticated user and performs a server-side HTTP request to retrieve feed content. The plugin then renders the fetched response back to the requesting user.

The vulnerable code path lacks a WordPress capability check before invoking the fetch routine. This means any authenticated user whose role grants access to post-editing screens, including the low-privilege contributor role, can trigger outbound requests from the WordPress host.

Because the response is reflected back to the user, this constitutes a full-read SSRF rather than a blind variant. Attackers can enumerate internal services, read cloud metadata endpoints, and retrieve content from hosts that are not exposed to the public internet.

Root Cause

The root cause is a missing authorization check [CWE-862] combined with user-controlled URL input used in a server-side request [CWE-918]. The plugin trusts that any logged-in user invoking the feed-fetch handler is permitted to specify arbitrary targets. No allowlist, scheme restriction, or internal-IP filter is applied before the HTTP request is issued.

Attack Vector

Exploitation requires authenticated access at the WordPress contributor role or higher. An attacker submits a crafted request to the vulnerable plugin endpoint supplying a URL pointing to an internal resource such as http://169.254.169.254/latest/meta-data/ on AWS, http://localhost:8080/, or an internal http://10.0.0.0/8 range host.

The WordPress server issues the request on behalf of the attacker and returns the response body. Attackers chain this primitive to enumerate internal services, access cloud instance metadata for credential theft, or reach administrative interfaces bound to loopback.

The vulnerability mechanism is documented in the WPScan Vulnerability advisory. No public proof-of-concept exploit code is referenced in the advisory.

Detection Methods for CVE-2026-89003

Indicators of Compromise

Unexpected outbound HTTP requests from the WordPress web server process to RFC1918 ranges, loopback, or cloud metadata IPs such as 169.254.169.254
WordPress access logs showing authenticated contributor accounts invoking WPeMatico plugin AJAX or admin-post endpoints at an elevated rate
Web server logs containing user-supplied URLs in parameters passed to WPeMatico feed-preview or fetch handlers

Detection Strategies

Monitor egress traffic from WordPress hosts for connections to internal IP ranges that originate from the PHP worker or web server user
Alert on HTTP requests from WordPress servers to known cloud metadata endpoints (169.254.169.254, metadata.google.internal, 100.100.100.200)
Review the WordPress audit trail for contributor-role accounts invoking plugin fetch functionality outside normal editorial workflows

Monitoring Recommendations

Enable verbose logging on the reverse proxy or WAF in front of WordPress to capture URL parameters sent to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php
Deploy egress filtering that blocks the WordPress host from reaching internal management networks and cloud metadata services except via a hardened proxy
Correlate newly created or recently promoted contributor accounts with subsequent plugin activity

How to Mitigate CVE-2026-89003

Immediate Actions Required

Upgrade the WPeMatico RSS Feed Fetcher plugin to version 2.8.27 or later on all WordPress installations
Audit WordPress user accounts and remove or downgrade unused contributor, author, and editor accounts
Restrict outbound network access from the WordPress host to only required destinations using host-based or network firewall rules

Patch Information

The vendor addressed the issue in WPeMatico RSS Feed Fetcher version 2.8.27 by introducing a capability check in the vulnerable fetch handler. Site operators should update via the WordPress plugin manager or by replacing the plugin directory with the patched release. Refer to the WPScan advisory for additional details.

Workarounds

Disable or uninstall the WPeMatico RSS Feed Fetcher plugin until the patched version can be deployed
Block IAM metadata endpoints and internal subnets at the host firewall so SSRF attempts return no useful content
Enforce a WAF rule that rejects requests to WPeMatico endpoints containing URL parameters pointing to private IP ranges, loopback, or metadata hostnames

bash

# Example iptables egress restriction for a WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT