The vulnerability resides in WPeMatico RSS Feed Fetcher, a WordPress plugin, where the system fails to verify that a user executing a feed campaign has permission to publish content or to attribute posts to other accounts. This flaw allows any user with contributor-level access or higher to create live posts and assign any registered user, including administrators, as the post author, enabling content injection and impersonation. The impact is the ability to publish unauthorized content and potentially manipulate author attribution, undermining content integrity and trust on the site.

WordPress sites running the WPeMatico RSS Feed Fetcher plugin before version 2.8.27 are affected. Any site that has installed this plugin in its unpatched state is at risk, regardless of the number of contributors or administrators present. The vulnerability is tied to the plugin's campaign settings and does not require external network access.

The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no publicly known exploits as of the data provided. However, the flaw can be exploited by authenticated users with contributor rights or higher, which are common roles on many sites. Given that the attacker does not need to compromise the server or install code, the attack vector is through the normal WordPress interface where the user runs a feed campaign. The lack of authorization checks means the impact is broad across all content posted through any campaign, providing a path for content subversion and potential phishing or defacement.