Description

Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-11T19:17:44.240Z",
  "pubdate": "2026-09-11T19:17:44.240Z",
  "executiveSummary": "Slim SEO versions 4.10.0 and below are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.\nThis flaw permits users with the Contributor role to manipulate metadata or internal object references that should be restricted to higher-privileged administrators or editors.\nThe vulnerability type is categorized as an IDOR, which arises when an application provides direct access to objects based on user-supplied input without performing adequate authorization checks.\nThe risk implication is unauthorized data modification or administrative configuration changes, potentially leading to SEO manipulation or site defacement.\nExploitation requires a valid user account with at least Contributor-level privileges, as the vulnerability resides within the internal processing of plugin-specific settings or SEO data management.\nThe impact is significant, as an attacker can influence site metadata, potentially affecting search engine indexing behaviors or altering site-wide SEO attributes through manipulated requests.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side authorization checks within the Slim SEO plugin when handling specific requests or object references during the plugin's meta-management operations.\nIn Slim SEO <= 4.10.0, the plugin fails to strictly validate whether a user session authenticated as a 'Contributor' possesses the necessary capabilities to read or update specific SEO-related object IDs passed through HTTP parameters.\nThe attack flow initiates when an authenticated Contributor intercepts the plugin's metadata update or retrieval requests. By identifying the object identifiers (such as post IDs, term IDs, or settings configuration IDs) involved in the request, an attacker can modify these values to point toward objects they should not have access to.\nSpecifically, the plugin logic does not verify the object ownership or the user's privilege level regarding the requested resource before processing the input. Consequently, the backend application trusts the object reference provided by the client side.\nAn attacker can exploit this by crafting a malicious POST request or modifying existing API calls, substituting legitimate identifiers with IDs belonging to unauthorized posts or global SEO settings. When the server processes this input, it executes the change on behalf of the attacker due to the lack of a proper access control layer at the function level.\nThe vulnerable components include the request handlers and the data processing functions responsible for saving or retrieving SEO metadata within the Slim SEO codebase. Because these functions rely on user-supplied input for object targeting, they effectively bypass the standard WordPress capability checks (e.g., current_user_can()).\nPost-exploitation, an attacker can persistently modify SEO titles, meta descriptions, or social sharing metadata for content they did not author. Furthermore, if global settings are reachable via the same IDOR flaw, the attacker may be able to alter site-wide SEO behaviors, potentially redirecting traffic or manipulating the site's presence in search engine results pages (SERPs).\nThe vulnerability is accessible to any user authenticated as a Contributor, effectively lowering the barrier for privilege escalation or content manipulation attacks that would otherwise be mitigated by the WordPress role-based access control system."
}