The WPeMatico RSS Feed Fetcher plugin for WordPress contains a missing nonce validation in the handle_feedback_submission() function. This flaw permits attackers to forge a request that will cause a site administrator to deactivate the plugin. The resulting impact is loss of plugin functionality, which can disrupt a site’s content‑feed features; the vulnerability is a classic Cross‑Site Request Forgery (CWE‑352) and does not provide execution or data‑exfiltration capabilities.

All instances of the etruel WPeMatico RSS Feed Fetcher plugin, including versions up to and including 2.8.7, are affected. Administrators using WordPress sites with this plugin should verify the installed version and consider the impact of a deactivated feed fetcher on their site’s operation.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of <1% suggests a very low likelihood of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated administrator to click a crafted link or otherwise interact with the forged request, so the risk is contingent on user interaction but can be mitigated by timely updates.