What is the CVSS score of CVE-2026-57429?

CVE-2026-57429 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Slim SEO CVE-2026-57429

EUVD-2026-39385 MEDIUM

Missing Authorization (CWE-862)

2026-06-25 Patchstack

GHSA-653g-xfpx-c824

WordPress Authentication Bypass Wordpress Plugin Slim Seo Elightup

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Contributor credentials required (PR:L); network-accessible plugin endpoint (AV:N); read-only data disclosure with no write or denial-of-service capability confirmed (I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:37 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

AnalysisAI

Broken access control in the Slim SEO WordPress plugin through version 4.6.2 allows authenticated users holding the Contributor role to bypass authorization checks and access restricted data, yielding a high confidentiality impact per CVSS C:H. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds sufficient privileges before executing certain privileged actions. No public exploit code and no CISA KEV listing exist at time of analysis; however, low attack complexity and no required user interaction make this straightforward to exploit by any valid contributor-level account holder.

Technical ContextAI

Slim SEO is a WordPress SEO plugin developed by elightup, designed to automate meta tags, sitemaps, breadcrumbs, and structured data for WordPress sites. The root cause is CWE-862 (Missing Authorization), a class of flaw where code executes sensitive operations without first verifying the caller's capability or role. WordPress enforces access control through its capability system; plugins must explicitly call current_user_can() or equivalent checks before exposing privileged data or functionality. The absence of such checks on one or more Slim SEO endpoints allows the Contributor role - a low-privilege built-in WordPress role - to reach functionality intended only for editors or administrators. The affected CPE cpe:2.3:a:elightup:slim_seo:*:*:*:*:*:*:*:* confirms all versions through 4.6.2 are impacted. Patchstack is the reporting source and maintains a dedicated advisory entry for this vulnerability.

RemediationAI

Update the Slim SEO plugin to a version released after 4.6.2. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/slim-seo/vulnerability/wordpress-slim-seo-plugin-4-6-2-broken-access-control-vulnerability should be consulted for the exact patched release version, as a precise fix version number is not independently confirmed from the available intelligence - verify the changelog in the WordPress plugin repository before deploying. As a compensating control pending patching, audit all accounts assigned the Contributor role and remove or demote any untrusted users, since exploitation requires a valid contributor-level session. Disabling open user registration under WordPress Settings > General (uncheck 'Anyone can register') eliminates the self-registration attack path at the cost of requiring manual user provisioning. Sites with a Patchstack subscription may benefit from virtual patching rules applied automatically at the WAF layer, though this should not substitute for the plugin update.