The vulnerability exists in the wpematico_test_feed() function of the WPeMatico RSS Feed Fetcher plugin, allowing any authenticated user with Subscriber or higher privileges to direct the web server to send HTTP requests to arbitrary URLs. By crafting the target URL, an attacker can query or manipulate services that are normally accessible only within the internal network, thereby exposing sensitive data or altering system state.

Any WordPress installation that has the WPeMatico RSS Feed Fetcher plugin version 2.8.11 or earlier is affected. The issue is limited to sites that have not applied the latest plugin update and require the presence of a Subscriber or higher role to trigger the vulnerable function.

The CVSS score of 6.4 reflects a moderate severity, and the EPSS score of less than 1% indicates a low probability of real‑world exploitation at this time. Because an attacker must first acquire authenticated access, the risk is contingent on the strength and scope of user roles on the site. The vulnerability is listed as not included in the CISA KEV catalog. The exploit path requires an attacker to send a crafted request to the wpematico_test_feed endpoint with a target URL parameter, causing the server to perform an outgoing request. Successful exploitation can result in disclosure of internal resources or modification of internal data. Given the typical internal network segmentation, the actual impact depends on what internal services are reachable from the web server. While the low EPSS score suggests a limited threat, the presence of authenticated access makes the vulnerability exploitable in environments where subscriber roles are widely granted.