What is the CVSS score of CVE-2026-16957?

CVE-2026-16957 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-16957?

Yes, a patch is available for CVE-2026-16957. Update the affected software to the latest version immediately.

Slim SEO CVE-2026-16957

EUVD-2026-54888 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-09 contact@wpscan.com

GHSA-c8x4-7vmf-m6pv

WordPress Authentication Bypass

2.7

CVSS 3.1 · Vendor: wpscan

Severity by source

Vendor (wpscan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Contributor is a low-privilege authenticated WordPress role (PR:L), not a high-privilege administrator; all other provided metrics are retained as accurate.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wpscan).

CVSS VectorVendor: wpscan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:21 vuln.today

CVSS changed

Aug 11, 2026 - 20:22 NVD

2.7 (LOW)

Patch available

Aug 09, 2026 - 07:16 EUVD

CVE Published

Aug 09, 2026 - 06:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types.

AnalysisAI

Slim SEO WordPress plugin before 4.9.11 allows authenticated Contributors to read arbitrary post meta - including protected and private keys - from published posts they do not own, by exploiting an authorization check that verifies read access instead of the required edit access on the post-meta preview feature. Affected data includes meta from password-protected posts and posts of non-public custom post types, exposing values such as API keys or license codes stored by co-installed plugins. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) indicates very low exploitation probability.

Technical ContextAI

The Slim SEO plugin (all versions < 4.9.11, EUVD-2026-54888) provides a post-meta preview feature intended for authors editing their own posts. The flaw, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), occurs because the plugin's endpoint resolves the target post by a user-supplied key (post ID) and validates only that the requesting user can read the post - a permissive check that grants access to all published content - rather than verifying the stricter edit capability that the feature demands. WordPress Contributors can read posts but cannot edit posts they do not own, making this check insufficient. Because post meta in WordPress is a generic key-value store used by many plugins for sensitive storage (API credentials, license keys, field values), the exposed data surface extends well beyond SEO metadata to any plugin that writes to post meta on affected post types.

RemediationAI

Update the Slim SEO WordPress plugin to version 4.9.11 or later, which is the vendor-released patch confirmed via WPScan advisory (https://wpscan.com/vulnerability/08e8c64b-50a4-4865-a33d-275644dcb850/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-16957). If an immediate update is not feasible, site administrators should audit and remove or demote untrusted Contributor accounts, since exploitation requires an authenticated session at that role level or above. As a more aggressive temporary measure, the Slim SEO plugin can be deactivated entirely - note this will strip SEO metadata (titles, descriptions, schema markup) from public-facing pages and may impact search engine indexing until the plugin is re-enabled. No workaround short of account restriction or plugin deactivation is available, as the flaw is in the server-side authorization logic of the plugin itself.