EUVD-2026-40937
GHSA-h4h4-h3cx-x6xc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L confirmed by required Contributor account; C:L because disclosure is via AI summaries, not verbatim raw content; no integrity or availability impact applies.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Slim SEO - A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the /wp-json/slim-seo/meta-tags/ai REST API endpoint. This is due to the endpoint's permission_callback performing only a top-level edit_posts capability check without verifying that the requesting user has read access to the specific post supplied via the object.ID parameter, allowing the generate function to pass the attacker-controlled post ID to Data::get_post_content(), which calls get_post() regardless of post status or ownership. This makes it possible for authenticated attackers with Contributor-level access and above to retrieve AI-generated summaries of the raw post_content of arbitrary posts they are not authorized to view - including private posts, drafts, pending, future, and password-protected content authored by other users - with the substance of the protected content disclosed via the HTTP response.
AnalysisAI
Unauthorized private content disclosure in the Slim SEO WordPress plugin (all versions through 4.9.8) allows authenticated Contributors to read protected content they do not own via the /wp-json/slim-seo/meta-tags/ai REST API endpoint. The endpoint's broken object-level authorization - checking only the generic edit_posts capability rather than per-post read access - lets any Contributor supply an arbitrary post ID and receive an AI-generated summary of that post's raw content, including private, draft, pending, future, and password-protected posts authored by other users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active WordPress session authenticated as a Contributor or higher role (Editor, Author, Administrator), confirmed by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) yielding a 4.3 Medium score is appropriate and consistent with the described behavior. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or already holds a Contributor account on a multi-author WordPress site running Slim SEO 4.9.8 or earlier. The attacker sends an authenticated POST request to `/wp-json/slim-seo/meta-tags/ai` with an `object.ID` set to an enumerated post ID belonging to a private draft authored by another user. … |
| Remediation | Update the Slim SEO plugin via the WordPress plugin dashboard or the official WordPress plugin repository to any version released after 4.9.8, where the fix changeset (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3576523%40slim-seo&new=3576523%40slim-seo) is incorporated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today