PT-2025-45087 · WordPress · Wpematico Rss Feed Fetcher

Rafshanzani Suhada · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-11917

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions up to and including 2.8.11

Description The WPeMatico RSS Feed Fetcher plugin for WordPress is susceptible to Server-Side Request Forgery via the wpematico test feed() function. Authenticated attackers with Subscriber-level access or higher can leverage this to make web requests to arbitrary locations from the web application, potentially allowing them to query and modify information from internal services.

Recommendations Update WPeMatico RSS Feed Fetcher to a version later than 2.8.11.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-11917

Affected Products

Wpematico Rss Feed Fetcher

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11917 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11917 · Vendor Advisory
• https://github.com/etruel/wpematico/commit/7a281dcfc0868490d62caee54f3b743708fed7cf · Note
• https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.11/app/wpematico_functions.php#L1260 · Note
• https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.11/app/wpematico_functions.php#L1249 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5a1c6377-c2a7-4344-86bd-d2797db19469?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.11/app/campaign_edit.php#L24 · Note
• https://t.me/CVEtracker/36594 · Telegram Post
• https://t.me/cveNotify/141770 · Telegram Post