CVE-2026-89004 Overview
CVE-2026-89004 is a broken access control vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.26. The plugin fails to verify ownership or authorization before returning a campaign's stored configuration and run log. Authenticated users with contributor-level access or above can read configuration data and execution logs belonging to campaigns created by other users, including administrators. The flaw maps to CWE-639: Authorization Bypass Through User-Controlled Key, a class of Insecure Direct Object Reference (IDOR) issue.
Critical Impact
Low-privileged WordPress contributors can retrieve sensitive campaign configurations and run logs of administrator-owned RSS feed campaigns, exposing feed sources, filters, and credentials embedded in logs.
Affected Products
- WPeMatico RSS Feed Fetcher WordPress plugin versions prior to 2.8.26
- WordPress sites running WPeMatico with contributor-level or higher user accounts enabled
- Multi-author WordPress installations relying on WPeMatico for RSS aggregation
Discovery Timeline
- 2026-09-24 - CVE-2026-89004 published to the National Vulnerability Database
- 2026-09-24 - Last updated in the NVD database
Technical Details for CVE-2026-89004
Vulnerability Analysis
The WPeMatico plugin exposes an authenticated endpoint that returns the stored configuration and execution log for a given campaign. The handler accepts a campaign identifier from the request but does not confirm that the requesting user owns the campaign or has the capability to view it. Any authenticated user holding a contributor role or above can supply an arbitrary campaign ID and receive the response.
Campaign configurations commonly contain feed URLs, API tokens for third-party sources, output post templates, author mappings, and scheduling details. Run logs can expose remote responses, debug output, and operational metadata written during campaign execution. Attackers who harvest this data gain reconnaissance value and may extract secrets stored by administrators.
Root Cause
The root cause is a missing authorization check on the campaign retrieval handler. The plugin treats authentication as sufficient and does not verify the relationship between the current user and the requested campaign object. This is a textbook IDOR pattern tracked under CWE-639.
Attack Vector
Exploitation requires an authenticated session with at least the WordPress contributor capability. The attacker issues a request to the vulnerable WPeMatico endpoint, enumerating or guessing campaign IDs. The server returns configuration and log data regardless of ownership. No user interaction is required beyond the attacker's own authenticated session.
No exploitation code is published alongside the advisory. Technical details are documented in the WPScan Vulnerability Analysis.
Detection Methods for CVE-2026-89004
Indicators of Compromise
- Repeated authenticated POST or GET requests from contributor-level accounts to WPeMatico AJAX actions referencing campaign identifiers the user does not own.
- Enumeration patterns where sequential or incrementing campaign_id values appear in request logs from a single session.
- Unexpected access to WPeMatico administrative AJAX actions originating from low-privilege user sessions.
Detection Strategies
- Review WordPress access logs for admin-ajax.php or REST requests containing WPeMatico action names submitted by non-administrator users.
- Correlate the WordPress user role of the requester against the owner of the requested campaign ID and flag mismatches.
- Deploy a Web Application Firewall rule that compares the authenticated user to the campaign owner and blocks cross-user access attempts.
Monitoring Recommendations
- Enable WordPress audit logging to capture AJAX and REST calls with the acting user, action name, and parameters.
- Alert on bursts of requests to WPeMatico endpoints from accounts that have never previously accessed campaign management functionality.
- Monitor for exfiltration-sized responses returned to contributor accounts from plugin AJAX handlers.
How to Mitigate CVE-2026-89004
Immediate Actions Required
- Upgrade the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later across all WordPress installations.
- Audit all WordPress users with contributor, author, or editor roles and remove inactive or unnecessary accounts.
- Rotate any API tokens, feed credentials, or secrets that were stored inside WPeMatico campaign configurations.
Patch Information
The vendor addressed the authorization check in WPeMatico version 2.8.26. Administrators should apply the update through the WordPress plugin dashboard or by replacing the plugin directory from the official repository. Refer to the WPScan Vulnerability Analysis for advisory details.
Workarounds
- Temporarily restrict access to the WordPress admin area for contributor-level accounts using an IP allowlist or SSO policy until the patch is applied.
- Deactivate the WPeMatico plugin on sites that cannot be updated immediately and have untrusted contributors.
- Deploy a WAF rule to block requests to WPeMatico campaign endpoints that originate from non-administrator sessions.
# Update WPeMatico via WP-CLI to the patched release
wp plugin update wpematico --version=2.8.26
# Verify the installed version matches the fixed release
wp plugin get wpematico --field=version
# List contributor-level and higher accounts for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.