CVE-2025-8103 is a CSRF vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin (up to version 2.8.7). The vulnerability arises from the absence of nonce validation in the handle_feedback_submission() function, enabling attackers to craft forged requests that can deactivate the plugin if an administrator is tricked into executing the action. The CVSS 3.1 score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, and impact limited to availability loss.

Successful exploitation allows an unauthenticated attacker to cause denial of service by deactivating the plugin, impacting availability. There is no impact on confidentiality or integrity. The attack requires user interaction (an administrator clicking a crafted link). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links and consider disabling or restricting access to the plugin's feedback submission functionality if possible.