Slim SEO CVE-2026-104001

Requires three concrete conditions: (1) an attacker-controlled Subscriber-level (or higher) account, which in practice means the site permits open user registration; (2) the attacker storing a shortcode payload in their own Biographical Info (user description) field via the WordPress REST API or the wp-admin profile editor; and (3) a front-end request that resolves that author's description without redirection - specifically an author archive reached through the ?author= query parameter while Slim SEO's auto_redirection setting is disabled. Limiting factors that reduce real-world risk: exploitation is authenticated (not anonymous), the author-description code path must actually be rendered to unauthenticated visitors, the non-default auto_redirection=disabled configuration is needed for the ?author= vector, and only versions up to and including 4.11.1 are affected (fixed in 4.11.2, which strips shortcodes from the bio). Actual impact further depends on which shortcodes other installed plugins expose.

This is a moderate, authentication-gated stored code-injection issue (CWE-94) rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) is internally consistent with the description: exploitation is network-reachable but requires PR:L - a Subscriber-level account - so per the precision rules this is authenticated exploitation, not unauthenticated. No EPSS score, SSVC decision, or CISA KEV status was supplied, and no POC/exploit flag is set, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV data is not itself a contradiction, but it means there is no evidence of active or at-scale exploitation to elevate priority. The real limiting factor is the need for a Subscriber account AND a non-default author-resolution path (auto_redirection disabled) for the stored shortcode to fire on front-end requests. Note a tension worth verifying: the vulnerability caps impact at C:L/I:L because base WordPress shortcodes are limited, but 'arbitrary shortcode execution' can escalate to significant impact (approaching RCE) if other installed plugins register dangerous shortcodes - so the 'RCE' tag is plausible only in specific stacks, and real-world severity is deployment-dependent. Overall: a legitimate issue to patch promptly on sites allowing open registration, but not a drop-everything item absent exploitation signals.

An attacker self-registers a Subscriber account on a WordPress site running Slim SEO <= 4.11.1 and saves a malicious shortcode into their own Biographical Info field via the REST API or the wp-admin profile page. When any unauthenticated visitor loads a page that resolves that author's description - for example an author archive reached via ?author= while auto_redirection is disabled - Slim SEO passes the bio through do_shortcode and the payload executes. No public exploit code is identified at time of analysis, but the patch diff (PR #296) publicly reveals the vulnerable do_shortcode call.