WPeMatico RSS Feed Fetcher < 2.8.26 – Contributor+ Campaign Configuration and Log Disclosure via IDOR | CVE 2026-89004

Description

The plugin does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.

Proof of Concept

The PoC will be displayed on October 06, 2026, to give users the time to update.

Affects Plugins

wpematico

Fixed in 2.8.26

References

CVE

CVE-2026-89004

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CWE-639

CVSS

2.7 (low)

Miscellaneous

Original Researcher

Karthik Ramakrishnan

Submitter

Karthik Ramakrishnan

Verified

Yes

WPVDB ID

1568f9e4-defe-423a-a631-e0afd829b972

Timeline

Publicly Published

2026-09-22 (about 2 days ago)

Added

2026-09-22 (about 1 day ago)

Last Updated

2026-09-22 (about 1 day ago)

Other

Published

Title

Published

2023-09-12

Title

wpDiscuz < 7.6.4 - Post Rating Increase/Decrease iva IDOR

Published

2024-11-19

Title

Image Optimizer, Resizer and CDN – Sirv < 7.3.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion

Published

2026-03-11

Title

WpStream < 4.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference

Published

2026-07-08

Title

Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR

Published

2026-01-02

Title

Roam <= 2.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference