Privilege Escalation in WPeMatico RSS Feed Fetcher Plugin for WordPress

The WPeMatico RSS Feed Fetcher plugin for WordPress (versions 2.8.24 and earlier) contains a critical security flaw involving the wpematico_import_settings function. The plugin fails to perform adequate capability checks when processing settings imports, allowing authenticated attackers with subscriber-level access to modify arbitrary options within the WordPress database.

By manipulating these options, an attacker can change the default user registration role to 'administrator' and enable the site's user registration feature. This allows the attacker to create new administrative accounts or elevate existing low-privileged accounts, granting them full control over the WordPress installation. This vulnerability represents a significant risk for site integrity and requires immediate patching of the plugin to the version containing the fix.

Impact

The vulnerability allows an authenticated attacker to achieve full administrative control over a WordPress site. By altering default site options such as 'users_can_register' and 'default_role', an attacker can bypass standard registration controls to gain elevated access. This impact extends to any organization utilizing the WPeMatico plugin, potentially affecting the confidentiality, integrity, and availability of the entire WordPress platform.

Recommendation

• Update the WPeMatico RSS Feed Fetcher plugin to the latest patched version immediately.
• Audit WordPress site options for unauthorized changes to the 'default_role' or 'users_can_register' settings.
• Implement stricter access control monitoring for plugins that perform sensitive database updates.