WordPress plugin WPeMatico RSS Feed Fetcher contains a flaw that allows an unauthorized party to retrieve sensitive system information. The vulnerability permits the extraction of embedded data such as configuration details or other confidential information. This is a classic sensitive data exposure issue, listed under CWE‑497, and can compromise the confidentiality of the site if an attacker can access the exposed data.

Affected deployments are WordPress sites running the etruel WPeMatico RSS Feed Fetcher plugin, versions from the earliest releases through 2.8.10 inclusive. Sites that still reference or install any of these versions are vulnerable.

The CVSS score of 4.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not currently listed in CISA KEV. However, an attacker who can induce the plugin to expose its data could obtain confidential information from the site. The likely attack vector involves the plugin’s data retrieval routines, which may be accessed via the WordPress admin interface or by exposing a file that contains the sensitive data.