WPeMatico, the WordPress plugin more than 10,000 sites use to auto-import content from RSS feeds, shipped version 2.8.27 on September 22, 2026, patching four vulnerabilities that let Contributor-level accounts overreach their role. Two are server-side request forgery bugs (CVE-2026-89000 and CVE-2026-89003) that let a low-privilege user make the server fetch internal-only addresses. A third, CVE-2026-89001, lets a Contributor publish a post live and credit it to any registered user, including an administrator. WordPress.org flags the release as a recommended security update.
What the four bugs actually let a Contributor do
WPeMatico’s entire job is fetching remote feed URLs and turning them into posts, so the plugin already talks to arbitrary web addresses on the server’s behalf. CVE-2026-89000 and CVE-2026-89003 exist because it never checked whether that destination was a genuine public feed or an internal address in disguise. According to WPScan’s advisory for CVE-2026-89000, a Contributor account, the same role many sites hand to guest writers or freelance content contributors, could point a campaign at an internal-only host and read back whatever the server received in response. Both SSRF flaws carry a WPScan-rated CVSS of 4.1.
CVE-2026-89001 is the more useful bug for an actual attacker. WPScan rates it 4.9 and describes a plugin that never verified a campaign runner was permitted to publish content or attribute it to someone else. A Contributor could run a feed campaign, have the resulting post go live without an editorial review step, and set the byline to any registered account, up to and including an admin.
A fourth issue, CVE-2026-89002, is a stored XSS bug WPScan rates 6.8, the highest severity of the group, though it was actually closed a version earlier in 2.8.26. It let a Contributor’s imported feed content run unsanitized script against whoever reviewed the campaign afterward, usually an editor or admin.
Who should care, and what to do
This matters most on sites that hand the Contributor role to people outside the core team: guest writers, freelance content contributors, or junior staff who submit posts for review before anything publishes. That’s exactly the trust boundary WPeMatico’s bugs erase.
- Update WordPress plugin WPeMatico to version 2.8.27 or later right away.
- Review which accounts currently hold the Contributor role and whether they still need it.
- Check recently published posts for authorship that doesn’t match who actually wrote them.
For agencies running multiple client sites with a mix of guest contributors and in-house writers, this is exactly the kind of gap a plugin audit is built to catch before a routine update cycle quietly does it for you. It’s also a reminder that WordPress’s own auto-blocking of high-risk plugin updates only stops the worst cases, not every contributor-level bug that slips through review.
