WordPress security changelog
MEDIUM CVE-2026-15947 Deferred

Metasync indexing settings can be changed by Subscribers

A Subscriber reaches save_instant_indexing_settings() on admin_init with submit and metasync_post_types POST values. Without a capability or nonce check, those values reach update_option() for metasync_options_instant_indexing and change which post types are automatically submitted to Google's Instant Indexing service. The export does not establish arbitrary unrelated option writes. Authoritative affected range: <= 2.6.23. No fixed release is confirmed in this review.

CVE / CNA score 4.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Search Atlas SEO – OTTO AI SEO Automation for WordPress
Plugin slug
metasync
Affected
<= 2.6.23
Safe version
See mitigation notes
Published
Sep 19, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Sep 19, 2026 and is one of 6 known issues for this plugin.

What to do

Update, patch or deactivate.

No confirmed fixed release. The newer security notes do not explicitly identify the instant-indexing post-type settings handler. Official changelog: https://wordpress.org/plugins/metasync/#developers . Require the intended plugin-management capability, validate the nonce and allowlist eligible post types before saving. Restrict this handler and restore authorized indexing configuration until updated.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources