CVE-2026-19883: CWE-269 Improper Privilege Management in etruel WPeMatico RSS Feed Fetcher

CVE-2026-19883 is an improper privilege management vulnerability (CWE-269) in the WPeMatico RSS Feed Fetcher WordPress plugin. The issue arises from the lack of a capability check on the wpematico_import_settings function, allowing authenticated users with minimal privileges (subscriber-level and above) to update arbitrary WordPress options. Attackers can exploit this to escalate privileges by setting the default registration role to administrator and enabling user registration, thereby gaining administrative access. This affects all versions up to and including 2.8.24.

An attacker with subscriber-level access or higher can escalate their privileges to administrator by modifying WordPress options, potentially leading to complete site compromise. This includes unauthorized data modification, full control over site settings, and the ability to create administrative users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and consider disabling user registration or limiting plugin usage. Monitor for updates from the vendor and apply patches promptly once released.