CVE-2026-12408
Received Received - Intake

Slim SEO Plugin Unauthorized Private Content Disclosure

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: Wordfence

Description
The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint. This is due to the endpoint's `permission_callback` performing only a top-level `edit_posts` capability check without verifying that the requesting user has read access to the specific post supplied via the `object.ID` parameter, allowing the `generate` function to pass the attacker-controlled post ID to `Data::get_post_content()`, which calls `get_post()` regardless of post status or ownership. This makes it possible for authenticated attackers with Contributor-level access and above to retrieve AI-generated summaries of the raw `post_content` of arbitrary posts they are not authorized to view — including private posts, drafts, pending, future, and password-protected content authored by other users — with the substance of the protected content disclosed via the HTTP response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-12408
EUVD
EUVD-2026-40937

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
slim_seo slim_seo to 4.9.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Slim SEO plugin for WordPress has a vulnerability in its REST API endpoint `/wp-json/slim-seo/meta-tags/ai` that allows unauthorized disclosure of private content. This happens because the endpoint only checks if the user has the general capability to edit posts, but does not verify if the user has permission to read the specific post identified by the `object.ID` parameter.

As a result, authenticated users with Contributor-level access or higher can retrieve AI-generated summaries of the raw content of posts they are not authorized to view. This includes private posts, drafts, pending, future, and password-protected posts authored by other users.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive or private content within a WordPress site using the Slim SEO plugin. Attackers with Contributor-level access or above can access AI-generated summaries of posts they should not see, potentially exposing confidential information, unpublished content, or password-protected material.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart