The WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.27 lacks proper authorization checks when executing feed campaigns, allowing any authenticated user with contributor-level access or higher to publish posts immediately and assign them to any registered author, including administrators. This flaw is a CWE‑269 Authorization Bypass vulnerability, enabling content injection and author impersonation and undermining content integrity and trust.

WordPress sites that have installed the WPeMatico RSS Feed Fetcher plugin with a version older than 2.8.27 are vulnerable. The issue applies regardless of the number of contributors or administrators; any user with contributor rights who can run a campaign can exploit the flaw.

The EPSS score is below one percent and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits today. The CVSS base score of 4.9 denotes moderate severity. Exploitation requires only an authenticated account with contributor privileges or higher; no remote code execution or server compromise is needed. Attackers can use the normal WordPress interface to launch a campaign and thereby inject malicious content or spoof authorship.