WordPress Plugin Vulnerabilities

Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated < 4.10.1 - Authenticated (Contributor+) Insecure Direct Object Reference

Description

The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
slim-seo
Fixed in 4.10.1

References

CVE
CVE-2026-62113
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1675d695-96e1-4fbe-ae42-42a4668f36e0

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (Low)

Miscellaneous

Original Researcher
Sybre Waaijer
Verified
No
WPVDB ID
d04283fc-11a1-400d-92b8-3b7cd843936c

Timeline

Publicly Published
2026-09-11 (about 1 month ago)
Added
2026-09-15 (about 1 month ago)
Last Updated
2026-09-15 (about 1 month ago)

Other

Published
Title
Published
2026-09-03
Title
Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR
Published
2023-09-12
Title
wpDiscuz < 7.6.4 - Unauthenticated Data Modification via IDOR
Published
2026-07-07
Title
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration < 4.3.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
Published
2022-08-02
Title
Affiliate For WooCommerce < 4.8.0 - Subscriber+ Paypal Email Update via IDOR
Published
2026-06-26
Title
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin < 1.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference