Slim SEO preview feature exposes protected post metadata to Contributors
Slim SEO before 4.9.11 checks only whether a user can read a post before returning its metadata preview and does not verify edit access. A Contributor can read arbitrary metadata, including protected and private keys, from published posts they do not own, including password-protected posts and posts belonging to non-public post types.
- Component
- Slim SEO
- Plugin slug
slim-seo- Affected
- < 4.9.11
- Safe version
4.9.11- Published
- Aug 09, 2026
This CVE was published Aug 09, 2026 and is one of 6 known issues for this plugin.
Update, patch or deactivate.
Update to 4.9.11 or later. Review low-privilege account activity and rotate secrets if sensitive credentials or tokens were stored in post metadata accessible during the vulnerable period.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N