EUVD-2026-83545
GHSA-46r6-v4x2-jgpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber-level account on target WP site
-
DeliverySend authenticated request to unprotected whitelabel-password action
-
ExploitOverwrite whitelabel password with attacker value
-
ExecutionUnlock whitelabel/general/advanced admin tabs
-
ImpactAlter protected plugin configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with subscriber-level access or above on a WordPress site running Search Atlas SEO / Otto AI (metasync) plugin version 2.6.23 or earlier; no user interaction and no non-default configuration are needed for the vulnerable action itself. Practical exploitation is limited by the need for a valid low-privilege account - most impactful on sites permitting open user registration - and the impact is confined to overwriting the whitelabel settings password to unlock the whitelabel, general, and advanced admin settings tabs (integrity only), with no direct confidentiality or availability impact. |
| Impact | This is a genuine but modest-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3 Medium) is internally consistent with the description: network-reachable, low complexity, but requiring authenticated subscriber-level access (PR:L) and delivering integrity-only impact (I:L) with no confidentiality or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided - so this is 'no public exploit identified at time of analysis.' The realistic risk is bounded by the authentication requirement (an attacker needs at least a subscriber account, common on open-registration sites but not universal) and by the narrow impact: overwriting the whitelabel password unlocks whitelabel/general/advanced admin settings tabs but does not by itself grant confidentiality loss or code execution. There are no conflicting signals in the data - CVSS network vector matches the WordPress-plugin REST/admin-action context. This is a legitimate broken-access-control flaw rather than a high-CVSS-but-low-real-risk inflation, but its Medium score and integrity-only, low-privilege-gated nature make it a routine-patch item, not an emergency. |
| Exploit ScenarioDerived | On a WordPress site running Search Atlas SEO / Otto AI <=2.6.23 that allows self-registration (or where the attacker holds any low-privilege account), the attacker authenticates as a subscriber and invokes the unprotected plugin action that sets the whitelabel settings password, choosing a value they control. They then use that password to unlock the whitelabel, general, and advanced configuration tabs and alter plugin/site configuration reserved for higher-privileged operators. No public exploit code was identified at the time of analysis, but the attack requires only a standard authenticated request with no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Authenticated attackers holding only subscriber-level access on a WordPress site running the Search Atlas SEO - Otto AI SEO Automation plugin (slug metasync) can tamper with the plugin's whitelabel settings because the affected code fails to verify that the caller is authorized to change them. By overwriting the whitelabel settings password to an attacker-chosen value, a low-privilege user can unlock the whitelabel, general, and advanced configuration tabs that are otherwise gated behind that password, giving them control over settings they should never reach. The flaw affects all versions up to and including 2.6.23 and is rated CVSS 4.3 (integrity-only impact, no confidentiality or availability loss); no public exploit code and no confirmed active exploitation were identified at time of analysis, and upstream code changes referencing the vulnerable routines have been published in the plugin's Trac changeset 3676919.
RemediationAI
Upstream code changes addressing the missing authorization check are published in the WordPress.org plugin Trac at https://plugins.trac.wordpress.org/changeset/3676919, reflecting an upstream fix (PR/commit/changeset); a released patched version number was not independently confirmed from the available data, so administrators should track the plugin's changelog and update the moment a build newer than 2.6.23 is published, and verify the installed version against the advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/56d839b0-b29d-4299-af77-1ce97a5925f6. Where the plugin cannot be updated immediately, the most effective compensating control is to remove the attack surface for low-privilege users: close open registration and audit existing subscriber accounts (side effect: legitimate self-service signups must be handled manually), and reduce the number of accounts holding even subscriber-level roles, since the flaw requires only an authenticated low-privilege session. Because the writable target is the whitelabel settings password, sites can also temporarily disable the whitelabel feature or the plugin itself if that functionality is not in active use (side effect: loss of whitelabel branding and configuration through the plugin), and administrators should monitor the plugin's options table for unexpected changes to the whitelabel password option so that any successful overwrite is detected and reset promptly. Blocking direct HTTP access to the plugin's admin and include PHP files is not a complete mitigation, as the vulnerable handler is reachable through normal WordPress request routing, so patching or deactivating the plugin remains the definitive fix; note that no vendor patch version, no public exploit code, and no confirmed active exploitation were identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-862 (Missing Authorization) in the WordPress plugin distributed under the slug metasync and marketed as Search Atlas SEO - Otto AI SEO Automation for WordPress (CPE cpe:2.3:a:shahrukhlinkgraph:search_atlas_seo_-_otto_ai_seo_automation_for_wordpress). WordPress plugins commonly expose privileged functionality through admin-ajax or REST handlers that are registered for logged-in users and then rely on a capability check or nonce before performing sensitive writes; when that check is omitted, any authenticated account - including a subscriber, the lowest default role - can invoke the handler. The referenced source files show where the logic lives: the connection/settings handling in includes/class-metasync-connect-manager.php (around line 1049), the settings registration in includes/class-metasync-settings-registration.php (around line 96), and the admin-side logic in admin/class-metasync-admin.php (around line 215). Together these implement the plugin's whitelabel mechanism, a gating pattern in which a separate password protects the whitelabel, general, and advanced configuration screens from ordinary administrators. Because the routine that stores or updates that whitelabel password does not confirm that the requestor is authorized (for example, by checking a manage_options-level capability or validating an appropriate nonce tied to an authorized user), a subscriber can supply a new password value and subsequently use it to open the protected tabs. The impact class is integrity-only: no read of secrets and no denial of service, but unauthorized modification of plugin configuration, which is exactly what the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N vector describes - network reachable, low complexity, requires low privileges, no user interaction, scope unchanged, low integrity impact.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable admin/REST action requiring only a subscriber account (PR:L, AC:L, UI:N); impact is limited to overwriting a settings password to unlock config tabs (I:L, C:N/A:N, scope unchanged).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Search Atlas SEO - Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB