CVE-2026-15947

Received Received - Intake

Unauthorized Post Type Modification in Metasync WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-15947

Affected Vendors & Products

Vendor	Product	Version / Range
metasync	metasync	to 2.6.23 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Metasync WordPress plugin has a flaw where the save_instant_indexing_settings() function lacks proper permission checks. This allows authenticated users with Subscriber-level access or higher to modify site-wide settings for Google Instant Indexing post types without verification.

Detection Guidance

Check WordPress sites using the Metasync plugin for unauthorized modifications to the 'metasync_options_instant_indexing' option. Review server logs for POST requests to admin-ajax.php or admin-post.php with 'metasync_post_types' parameter from non-admin users.

Impact Analysis

Attackers could change which post types are automatically submitted to Google's Instant Indexing service, potentially exposing sensitive content or manipulating search engine visibility of your site.

Compliance Impact

This vulnerability allows authenticated attackers with Subscriber-level access to modify site-wide settings, potentially altering which post types are auto-submitted to Google's Instant Indexing service. While not directly violating GDPR or HIPAA, unauthorized data submission could lead to improper handling of sensitive data, potentially violating compliance if personal or health information is exposed or processed incorrectly.

Mitigation Strategies

Update the Metasync plugin to the latest version if available. Remove or disable the plugin if no update is provided. Implement strict access controls to prevent Subscriber-level users from modifying plugin settings.

Hi! I’m here to help you understand CVE-2026-15947. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70