Answer in brief
CVE-2026-12408 records a Medium severity (CVSS 4.3) vulnerability in Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter. The current sources do not mark it as known exploited. The current feed maps rilwis/Slim SEO – A Fast & Automated SEO Plugin For WordPress (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-12408 records a Medium severity (CVSS 4.3) vulnerability in Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter. The current sources do not mark it as known exploited. The current feed maps rilwis/Slim SEO – A Fast & Automated SEO Plugin For WordPress (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rilwis/Slim SEO – A Fast & Automated SEO Plugin For WordPress (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rilwis/Slim SEO – A Fast & Automated SEO Plugin For WordPressgeneric | 0 | Not reported |
Published upstream
Jul 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 1, 2026
The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint. This is due to the endpoint's `permission_callback` performing only a top-level `edit_posts` capability check without verifying that the requesting user has read access to the specific post supplied via the `object.ID` parameter, allowing the `generate` function to pass the attacker-controlled post ID to `Data::get_post_content()`, which calls `get_post()` regardless of post status or ownership. This makes it possible for authenticated attackers with Contributor-level access and above to retrieve AI-generated summaries of the raw `post_content` of arbitrary posts they are not authorized to view — including private posts, drafts, pending, future, and password-protected content authored by other users — with the substance of the protected content disclosed via the HTTP response.
Quoted source text, attributed separately from HOL analysis.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rilwis/Slim SEO – A Fast & Automated SEO Plugin For WordPress (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rilwis/Slim SEO – A Fast & Automated SEO Plugin For WordPressgeneric | 0 | Not reported |
Published upstream
Jul 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 1, 2026
The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint. This is due to the endpoint's `permission_callback` performing only a top-level `edit_posts` capability check without verifying that the requesting user has read access to the specific post supplied via the `object.ID` parameter, allowing the `generate` function to pass the attacker-controlled post ID to `Data::get_post_content()`, which calls `get_post()` regardless of post status or ownership. This makes it possible for authenticated attackers with Contributor-level access and above to retrieve AI-generated summaries of the raw `post_content` of arbitrary posts they are not authorized to view — including private posts, drafts, pending, future, and password-protected content authored by other users — with the substance of the protected content disclosed via the HTTP response.
Quoted source text, attributed separately from HOL analysis.