WPeMatico RSS Feed Fetcher Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WPeMatico RSS Feed Fetcher plugin for WordPress, affecting all versions through 2.8.7. The vulnerability arises from a lack of nonce validation in the 'handle_feedback_submission' function, allowing unauthenticated attackers to deactivate the plugin by sending a forged request, provided they can manipulate a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can trick a user into performing actions they did not intend to, such as deactivating a plugin.

Reproduction

To reproduce this vulnerability, an attacker must send a forged request to the 'handle_feedback_submission' AJAX action without a valid nonce. This can be done by tricking an administrator into clicking a link that activates the request, effectively deactivating the WPeMatico plugin.

Remediation

Users are advised to update the WPeMatico RSS Feed Fetcher plugin to version 2.8.8 or later, where this vulnerability has been patched.