The WPeMatico RSS Feed Fetcher plugin contains an authenticated privilege escalation vulnerability that could allow low-privileged users to gain administrative rights.

The plugin fails to perform an adequate capability check on the wpematico_import_settings function (CWE-269). This allows an authenticated attacker, such as a subscriber, to modify plugin settings and potentially escalate their privileges within the WordPress environment.

With a CVSS score of 8.8, this vulnerability poses a severe threat to site administration. A successful exploit allows a low-privileged user to gain unauthorized control over plugin configurations, which can be leveraged to compromise the entire WordPress installation, leading to data loss or complete unauthorized administrative access.

Immediate Action: Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.25 or later. This update includes the necessary capability checks to prevent unauthorized access.

Proactive Monitoring: Audit user account activity and plugin configuration changes within the WordPress dashboard to identify any unauthorized modifications.

Compensating Controls: Limit the ability of low-privileged users to access sensitive plugin dashboards where possible, and ensure that administrative access is restricted to authorized personnel only.

Public Exploit Available: Unknown

Privilege escalation vulnerabilities are critical in a content management context. Administrators must apply the update to version 2.8.25 immediately to ensure that only authorized users can modify plugin settings and maintain the integrity of site administration.