Slim Seo
Monthly
Slim SEO WordPress plugin versions up to and including 4.10.0 exposes an Insecure Direct Object Reference (IDOR) vulnerability exploitable by authenticated contributors. With only contributor-level access (PR:L), an attacker can access SEO-related data objects - such as post metadata or SEO settings - that belong to other users or posts they are not authorized to view. The vulnerability is limited to confidentiality impact (C:L) with no integrity or availability consequence, and no public exploit has been identified at time of analysis.
Broken access control in the Slim SEO WordPress plugin through version 4.6.2 allows authenticated users holding the Contributor role to bypass authorization checks and access restricted data, yielding a high confidentiality impact per CVSS C:H. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds sufficient privileges before executing certain privileged actions. No public exploit code and no CISA KEV listing exist at time of analysis; however, low attack complexity and no required user interaction make this straightforward to exploit by any valid contributor-level account holder.
Slim SEO WordPress plugin versions up to and including 4.10.0 exposes an Insecure Direct Object Reference (IDOR) vulnerability exploitable by authenticated contributors. With only contributor-level access (PR:L), an attacker can access SEO-related data objects - such as post metadata or SEO settings - that belong to other users or posts they are not authorized to view. The vulnerability is limited to confidentiality impact (C:L) with no integrity or availability consequence, and no public exploit has been identified at time of analysis.
Broken access control in the Slim SEO WordPress plugin through version 4.6.2 allows authenticated users holding the Contributor role to bypass authorization checks and access restricted data, yielding a high confidentiality impact per CVSS C:H. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds sufficient privileges before executing certain privileged actions. No public exploit code and no CISA KEV listing exist at time of analysis; however, low attack complexity and no required user interaction make this straightforward to exploit by any valid contributor-level account holder.