Post-Meta Access Vulnerability in Slim SEO Plugin by WordPress
CVE-2026-16957
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16957?
The Slim SEO WordPress plugin prior to version 4.9.11 allows users with the Contributor role to access post-meta data that they should not be able to view. This vulnerability occurs because the plugin does not adequately restrict access to the post-meta preview feature. As a result, users can read arbitrary post meta information, including sensitive data such as protected keys from published posts that they do not own, in addition to accessing password-protected entries and private custom post types.
Affected Version(s)
Slim SEO 0 < 4.9.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.