Slim SEO Plugin Unauthorized Private Content Disclosure

Executive Summary

The Slim SEO plugin for WordPress has a vulnerability in its REST API endpoint `/wp-json/slim-seo/meta-tags/ai` that allows unauthorized disclosure of private content. This happens because the endpoint only checks if the user has the general capability to edit posts, but does not verify if the user has permission to read the specific post identified by the `object.ID` parameter.

As a result, authenticated users with Contributor-level access or higher can retrieve AI-generated summaries of the raw content of posts they are not authorized to view. This includes private posts, drafts, pending, future, and password-protected posts authored by other users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring requests to the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint on your WordPress site. Specifically, look for requests that include the `object.ID` parameter, which is used to specify the post ID. Anomalous or unauthorized access attempts to this endpoint by users with Contributor-level access or above may indicate exploitation attempts.

You can use network monitoring tools or web server logs to identify such requests. For example, using command-line tools like `grep` on your web server access logs to find requests to this endpoint:

• grep "/wp-json/slim-seo/meta-tags/ai" /var/log/apache2/access.log
• grep "/wp-json/slim-seo/meta-tags/ai" /var/log/nginx/access.log

Additionally, you can use curl commands to test if the endpoint is accessible and returns content for posts you should not have access to, for example:

• curl -X GET "https://yourwordpresssite.com/wp-json/slim-seo/meta-tags/ai?object.ID=POST_ID" -b "cookie_with_authenticated_user_session"

Replace `POST_ID` with the ID of a private or restricted post and use an authenticated session cookie of a user with Contributor-level access to check if unauthorized content is disclosed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive or private content within a WordPress site using the Slim SEO plugin. Attackers with Contributor-level access or above can access AI-generated summaries of posts they should not see, potentially exposing confidential information, unpublished content, or password-protected material.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated attackers with Contributor-level access and above to retrieve AI-generated summaries of the raw post content of arbitrary posts they are not authorized to view, including private, draft, pending, future, and password-protected content authored by other users.

Such unauthorized disclosure of private content could lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

By exposing protected content without proper authorization, the vulnerability undermines confidentiality requirements essential for compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should update the Slim SEO plugin to a version later than 4.9.8 where this issue is fixed.

If an update is not immediately available, consider temporarily disabling the Slim SEO plugin or restricting access to the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint to trusted users only.

Additionally, review user roles and permissions to ensure that only trusted users have Contributor-level access or higher, as this vulnerability requires at least Contributor-level privileges to exploit.

Implementing web application firewall (WAF) rules to block or monitor suspicious requests to the vulnerable endpoint can also help reduce risk until a patch is applied.

Useful 0 Not Useful 0