CVE-2025-11917 is a Server-Side Request Forgery (CWE-918) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin, affecting all versions up to and including 2.8.11. The issue arises in the wpematico_test_feed() function, allowing authenticated attackers with at least Subscriber privileges to induce the server to send HTTP requests to arbitrary locations. This can be leveraged to interact with internal network services or resources that are otherwise inaccessible externally. The vulnerability has a CVSS v3.1 score of 6.4, reflecting a medium impact with network attack vector, low attack complexity, and limited privileges required.

Exploitation allows an authenticated user with Subscriber-level or higher privileges to cause the server hosting the plugin to make arbitrary HTTP requests. This can lead to unauthorized querying or modification of internal services and data accessible from the server's network context. The confidentiality and integrity of internal resources may be compromised. There is no indication of direct availability impact. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix links are provided, users should monitor etruel's advisories for updates. Until a fix is available, consider restricting Subscriber-level access or disabling the wpematico_test_feed() functionality if feasible to reduce risk.