The WPeMatico RSS Feed Fetcher plugin for WordPress before version 2.8.27 does not perform a capability check before fetching a user‑supplied URL, allowing users with contributor‑level access or higher to force the server to issue requests to internal‑only hosts and read the responses back. This can be used to enumerate or exfiltrate data from internal services, potentially enabling further attacks.

Affected products include the WPeMatico RSS Feed Fetcher WordPress plugin, versions prior to 2.8.27.

The vulnerability can be exploited through the campaign preview feature. An attacker with contributor privileges can supply a malicious URL that points to internal addresses; the plugin will fetch the content without validation. Although no remote code execution is directly granted, the ability to read internal host responses can lead to data leakage and facilitate advanced internal reconnaissance. The CVSS score of 4.1 indicates medium severity, and the EPSS score of < 1% suggests the flaw is unlikely to be widely exploited, yet the lack of a capability check makes it actionable if a vulnerable instance is identified. The vulnerability is not listed in CISA’s KEV catalog, but the combination of internal data exposure and the SSRF nature still warrants remediation.