CVE-2026-57429
MediumCVSS 6.5Summary
The Slim SEO plugin versions up to 4.6.2 contain a vulnerability involving broken access control for contributors. A user with the contributor role can gain unauthorized access to SEO management functions.
Risk Assessment
The risk involves the possibility of unauthorized users modifying SEO settings, which can lead to content integrity violations and potential SEO attacks.
Recommendation
It is recommended to immediately update the Slim SEO plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Slim SEO <= 4.6.2
See all- CVE-2026-62113Medium
The Slim SEO plugin in versions up to and including 4.10.0 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they do not have permission to.
- CVE-2026-12408Medium
The Slim SEO plugin for WordPress up to version 4.9.8 contains a vulnerability allowing unauthorized disclosure of private content. The issue is in the REST API endpoint `/wp-json/slim-seo/meta-tags/ai`, which does not properly verify user permissions to read a specific post, enabling authenticated attackers with Contributor-level access or higher to retrieve summaries of any post's content, including private, draft, pending, future, and password-protected posts.
Original NVD description (English source)
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.