CVE-2025-49922: 
WordPress vulnerability analysis and mitigation

CVE-2025-49922 is a Missing Authorization (Broken Access Control) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin developed by etruel. It allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels, potentially performing actions beyond their intended permissions. The vulnerability affects all versions of the plugin up to and including 2.8.3, with version 2.8.4 containing the fix. It was reported on April 29, 2025, published by Patchstack on May 29, 2025, and assigned a CVE on October 22, 2025. The CVSS v3.1 base score is 4.3 (Medium), assigned by Patchstack (Patchstack Advisory).

The root cause is CWE-862 (Missing Authorization) — the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions. This falls under OWASP Top 10 A1: Broken Access Control. An authenticated attacker with Subscriber-level access can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles (e.g., administrators), due to the absence of adequate authorization checks. No complex preconditions are required beyond having a valid low-privilege account on the target WordPress site (Patchstack Advisory).

Successful exploitation results in a limited integrity impact — an authenticated low-privilege user can perform unauthorized actions within the plugin that should be restricted to higher-privileged users. There is no confidentiality or availability impact per the CVSS assessment (C:N/I:L/A:N). The scope is limited to the affected WordPress plugin's functionality, and there is no evidence of lateral movement potential or significant data exposure risk associated with this vulnerability (Patchstack Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact, though they note that broken access control vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack Advisory).

The primary remediation is to update the WPeMatico RSS Feed Fetcher plugin to version 2.8.4 or later, which contains the fix for this vulnerability. If an immediate update is not possible, consider temporarily disabling the plugin or restricting access to the WordPress site at the network level. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically. Administrators should also review user roles and restrict Subscriber-level accounts if not required (Patchstack Advisory).