CVE-2025-8103

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8103", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-23T21:50:35.383Z", "datePublished": "2025-07-26T03:38:18.084Z", "dateUpdated": "2026-04-08T16:49:21.695Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:21.695Z"}, "affected": [{"vendor": "etruel", "product": "WPeMatico RSS Feed Fetcher", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.8.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to missing nonce validation in the handle_feedback_submission() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4473de39-a122-4c2e-9f64-50157b589a28?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.7/app/plugin_functions.php#L207"}, {"url": "https://wordpress.org/plugins/wpematico/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3333908/"}, {"url": "https://www.wpematico.com/releases/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "timeline": [{"time": "2025-07-24T17:22:12.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-25T14:59:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-28T18:58:28.802544Z", "id": "CVE-2025-8103", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-28T18:58:33.811Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8103", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-28T18:58:28.802544Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-28T18:58:31.036Z"}}], "cna": {"title": "WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function", "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}}], "affected": [{"vendor": "etruel", "product": "WPeMatico RSS Feed Fetcher", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.8.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-24T17:22:12.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-25T14:59:17.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4473de39-a122-4c2e-9f64-50157b589a28?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.7/app/plugin_functions.php#L207"}, {"url": "https://wordpress.org/plugins/wpematico/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3333908/"}, {"url": "https://www.wpematico.com/releases/"}], "descriptions": [{"lang": "en", "value": "The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to missing nonce validation in the handle_feedback_submission() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-26T03:38:18.084Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8103", "state": "PUBLISHED", "dateUpdated": "2025-07-28T18:58:33.811Z", "dateReserved": "2025-07-23T21:50:35.383Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-26T03:38:18.084Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPeMatico RSS Feed Fetcher", "vendor": "etruel", "versions": [{"lessThanOrEqual": "2.8.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to missing nonce validation in the handle_feedback_submission() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento WPeMatico RSS Feed Fetcher para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.8.7 incluida. Esto se debe a la falta de validaci\u00f3n de nonce en la funci\u00f3n handle_feedback_submission(). Esto permite que atacantes no autenticados desactiven el complemento mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-8103", "lastModified": "2026-06-17T10:06:18.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8103", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-28T18:58:28.802544Z", "version": "2.0.3"}}]}, "published": "2025-07-26T04:16:10.310", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.7/app/plugin_functions.php#L207"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3333908/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wpematico/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4473de39-a122-4c2e-9f64-50157b589a28?source=cve"}, {"source": "security@wordfence.com", "url": "https://www.wpematico.com/releases/"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:49:51.948680+00:00", "value": {"mitigation_remediation": ["Update the WPeMatico RSS Feed Fetcher plugin to a version newer than 2.8.7, preferably the latest release. ", "If an immediate update is not possible, remove or disable the handle_feedback_submission script or hook to eliminate the unprotected endpoint. ", "Implement a temporary CSRF protection by adding a nonce check on the feedback submission route or by blocking that URL for non\u2011admin users via server firewall or .htaccess."], "summary": {"action": "Immediate Update", "impact": "Cross\u2011Site Request Forgery allowing unauthenticated users to deactivate the WPeMatico plugin"}, "threat_synthesis": {"affected_systems": "All instances of the etruel WPeMatico RSS Feed Fetcher plugin, including versions up to and including 2.8.7, are affected. Administrators using WordPress sites with this plugin should verify the installed version and consider the impact of a deactivated feed fetcher on their site\u2019s operation.", "description_and_impact": "The WPeMatico RSS Feed Fetcher plugin for WordPress contains a missing nonce validation in the handle_feedback_submission() function. This flaw permits attackers to forge a request that will cause a site administrator to deactivate the plugin. The resulting impact is loss of plugin functionality, which can disrupt a site\u2019s content\u2011feed features; the vulnerability is a classic Cross\u2011Site Request Forgery (CWE\u2011352) and does not provide execution or data\u2011exfiltration capabilities.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of <1% suggests a very low likelihood of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated administrator to click a crafted link or otherwise interact with the forged request, so the risk is contingent on user interaction but can be mitigated by timely updates."}}}}, "created": "2025-07-28T12:45:43.446186+00:00", "updated": "2026-04-21T04:00:10.053811+00:00", "vendors": ["etruel", "etruel$PRODUCT$wpematico_rss_feed_fetcher", "wordpress", "wordpress$PRODUCT$wordpress"]}