Search Atlas Seo Otto Ai Seo Automation For Wordpress
Monthly
Authenticated attackers holding only subscriber-level access on a WordPress site running the Search Atlas SEO - Otto AI SEO Automation plugin (slug metasync) can tamper with the plugin's whitelabel settings because the affected code fails to verify that the caller is authorized to change them. By overwriting the whitelabel settings password to an attacker-chosen value, a low-privilege user can unlock the whitelabel, general, and advanced configuration tabs that are otherwise gated behind that password, giving them control over settings they should never reach. The flaw affects all versions up to and including 2.6.23 and is rated CVSS 4.3 (integrity-only impact, no confidentiality or availability loss); no public exploit code and no confirmed active exploitation were identified at time of analysis, and upstream code changes referencing the vulnerable routines have been published in the plugin's Trac changeset 3676919.
Missing authorization and nonce checks in the Metasync plugin (distributed as Search Atlas SEO - Otto AI SEO Automation for WordPress) up to and including version 2.6.23 allow any authenticated user with Subscriber-level access or higher to overwrite the site-wide 'metasync_options_instant_indexing' option. Because save_instant_indexing_settings() is hooked to admin_init and only tests for the presence of $_POST['submit'], an attacker with a low-privilege login can silently change which post types are auto-submitted to Google's Instant Indexing service; no public exploit code has been identified at time of analysis, no CISA KEV entry applies, and the impact is integrity-only (CVSS 4.3, I:L) with no data disclosure or denial of service.
Authenticated attackers holding only subscriber-level access on a WordPress site running the Search Atlas SEO - Otto AI SEO Automation plugin (slug metasync) can tamper with the plugin's whitelabel settings because the affected code fails to verify that the caller is authorized to change them. By overwriting the whitelabel settings password to an attacker-chosen value, a low-privilege user can unlock the whitelabel, general, and advanced configuration tabs that are otherwise gated behind that password, giving them control over settings they should never reach. The flaw affects all versions up to and including 2.6.23 and is rated CVSS 4.3 (integrity-only impact, no confidentiality or availability loss); no public exploit code and no confirmed active exploitation were identified at time of analysis, and upstream code changes referencing the vulnerable routines have been published in the plugin's Trac changeset 3676919.
Missing authorization and nonce checks in the Metasync plugin (distributed as Search Atlas SEO - Otto AI SEO Automation for WordPress) up to and including version 2.6.23 allow any authenticated user with Subscriber-level access or higher to overwrite the site-wide 'metasync_options_instant_indexing' option. Because save_instant_indexing_settings() is hooked to admin_init and only tests for the presence of $_POST['submit'], an attacker with a low-privilege login can silently change which post types are auto-submitted to Google's Instant Indexing service; no public exploit code has been identified at time of analysis, no CISA KEV entry applies, and the impact is integrity-only (CVSS 4.3, I:L) with no data disclosure or denial of service.