The WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.27 does not perform a capability check or validate the destination of a user‑supplied feed URL when a campaign is executed. This omission allows a user with contributor-level or higher permissions to trigger the plugin’s server‑side fetch routine, causing the web server to retrieve arbitrary URLs of the attacker’s choosing. The attack yields a Server Side Request Forgery, enabling access to internal‑only resources or restricted endpoints and returning the fetched content back to the user, thereby compromising confidentiality and providing potential footholds for further exploitation.

Only the WPeMatico RSS Feed Fetcher WordPress plugin is affected; versions earlier than 2.8.27 contain the flaw. The CNA does not list a formal vendor, but the product name is used in the plugin directory. Any WordPress installation that has this plugin and assigns contributor or higher roles is vulnerable.

The EPSS score is less than 1% and the CVSS score is 4.1, indicating a moderate likelihood of exploitation but a moderate severity impact. The flaw is not listed in the CISA KEV catalog, which suggests that no widespread, publicly known exploitation campaigns have been documented for this vulnerability. The attack path is straightforward for any user with contributor-level access or higher. By supplying a malicious feed URL when running a campaign, the attacker can have the server issue internal HTTP requests and return the response content. This requires no special conditions beyond the capability to execute campaign run actions. Because the attacker can target internal-only resources, the potential impact includes exposure of confidential data from internal services. While the immediate impact is limited to confidentiality, successful data exfiltration could serve as a foothold for further lateral movement or privilege escalation within the environment.