CVE-2026-62113
MediumCVSS 4.3Summary
The Slim SEO plugin in versions up to and including 4.10.0 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they do not have permission to.
Risk Assessment
A low-privileged user may read or modify data belonging to other users, potentially leading to information disclosure or unauthorized changes in SEO configuration.
Recommendation
Update the Slim SEO plugin to a version newer than 4.10.0 once a fix is released and consider limiting Contributor-role accounts.
Other vulnerabilities in Slim SEO
See all- CVE-2026-57429Medium
The Slim SEO plugin versions up to 4.6.2 contain a vulnerability involving broken access control for contributors. A user with the contributor role can gain unauthorized access to SEO management functions.
- CVE-2026-12408Medium
The Slim SEO plugin for WordPress up to version 4.9.8 contains a vulnerability allowing unauthorized disclosure of private content. The issue is in the REST API endpoint `/wp-json/slim-seo/meta-tags/ai`, which does not properly verify user permissions to read a specific post, enabling authenticated attackers with Contributor-level access or higher to retrieve summaries of any post's content, including private, draft, pending, future, and password-protected posts.
Original NVD description (English source)
Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.