Metasync WordPress Plugin CVE-2026-15947

Requires an authenticated account at Subscriber level or above on a WordPress site running the Metasync (Search Atlas SEO - Otto AI) plugin version 2.6.23 or earlier; the save_instant_indexing_settings() function must be reachable via the admin_init hook (default plugin behavior). The only request precondition is presence of $_POST['submit'] alongside the attacker-supplied $_POST['metasync_post_types']; no nonce and no capability are validated. Limiting factors: exploitation is confined to modifying the Instant Indexing post-type configuration (integrity-only, no data disclosure or DoS), and it requires a valid low-privilege login, so sites that disallow open user registration substantially reduce exposure.

This is a genuine-but-low-severity authorization flaw, consistent with its 4.3 CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N shows network-reachable, low-complexity exploitation requiring only Subscriber-level authentication (PR:L), with impact confined to integrity (I:L) and no confidentiality or availability loss. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or automated exploitation; treat exploitation status as 'no public exploit identified at time of analysis.' The realistic ceiling is low: an attacker can only alter which post types the site auto-submits to Google's Instant Indexing service - a nuisance/SEO-tampering integrity issue, not data theft or takeover. Note that the 'Authentication Bypass' tag conflicts with the actual weakness: CWE-862 (missing authorization) plus a PR:L vector describe a broken-access-control issue for an already-authenticated low-privilege user, NOT an authentication bypass. Prioritize patching but this is not a drop-everything emergency.

An attacker who has (or self-registers for) a Subscriber account on a WordPress site running Metasync <=2.6.23 sends a crafted POST request containing 'submit' and a chosen 'metasync_post_types' value to an admin_init-hooked endpoint. Because the handler performs no capability or nonce check, the site-wide 'metasync_options_instant_indexing' option is overwritten, letting the attacker control which post types are auto-submitted to Google Instant Indexing. No public exploit code is identified, and exploitation is limited to integrity impact on SEO/indexing configuration.