CVE-2026-19883 is a privilege escalation vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin caused by improper privilege management (CWE-269). The wpematico_import_settings function lacks a capability check, enabling authenticated users with low-level privileges (subscriber and above) to update arbitrary WordPress options. This can be exploited to set the default role for new registrations to administrator and enable user registration, effectively granting attackers administrative control over the site. The vulnerability affects all versions up to and including 2.8.24. There is no vendor advisory or patch currently available.

Successful exploitation allows authenticated users with minimal privileges to escalate their access to full administrative control of the WordPress site. This compromises confidentiality, integrity, and availability of the site, enabling attackers to modify site settings, create admin users, and potentially take over the entire site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and consider disabling or removing the WPeMatico RSS Feed Fetcher plugin if possible. Monitor for updates from the vendor regarding an official patch or mitigation.