[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fah_7ptq3VJEx-bDd6hZHXVC3LlHxCT6f_wHW2Z8FjvU":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-12408","slim-seo-authenticated-contributor-insufficient-authorization-to-private-content-disclosure-via-objectid-parameter","Slim SEO \u003C= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter","The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the `\u002Fwp-json\u002Fslim-seo\u002Fmeta-tags\u002Fai` REST API endpoint. This is due to the endpoint's `permission_callback` performing only a top-level `edit_posts` capability check without verifying that the requesting user has read access to the specific post supplied via the `object.ID` parameter, allowing the `generate` function to pass the attacker-controlled post ID to `Data::get_post_content()`, which calls `get_post()` regardless of post status or ownership. This makes it possible for authenticated attackers with Contributor-level access and above to retrieve AI-generated summaries of the raw `post_content` of arbitrary posts they are not authorized to view — including private posts, drafts, pending, future, and password-protected content authored by other users — with the substance of the protected content disclosed via the HTTP response.","slim-seo",null,"\u003C=4.9.8","4.9.9","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-06-30 19:21:44","2026-07-01 07:53:37",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F6e6603a0-8f35-49fb-a517-ba6344538c4d?source=api-prod",1,[22,23,24,25,26,27,28,29],"js\u002Fbuild\u002Fmeta-tags.asset.php","js\u002Fbuild\u002Fmeta-tags.js","js\u002Fbuild\u002Fsingle.asset.php","js\u002Fbuild\u002Fsingle.js","js\u002Fsettings-ai.js","readme.txt","slim-seo.php","src\u002FIntegrations\u002FACF\u002FRenderer.php","researched",false,3,"# Research Plan: CVE-2026-12408 - Slim SEO Private Content Disclosure\n\n## 1. Vulnerability Summary\nThe **Slim SEO** plugin (versions \u003C= 4.9.8) contains an authorization bypass vulnerability in its AI-powered meta-tag generation REST API endpoint. The endpoint `\u002Fwp-json\u002Fslim-seo\u002Fmeta-tags\u002Fai` is intended to allow users with the `edit_posts` capability (Contributor level and above) to generate SEO summaries. \n\nHowever, the `permission_callback` for this route only verifies the user's top-level capability (`edit_posts`) and fails to check if the user has permission to read the specific post identified by the `object.ID` parameter. Consequently, the `generate` function passes this ID to `Data::get_post_content()`, which retrieves post data via `get_post()` without regard for post status (private, draft, password-protected) or ownership. This allows an attacker to obtain AI-generated summaries of sensitive content they are not authorized to view.\n\n## 2. Attack Vector Analysis\n- **REST API Endpoint:** `\u002Fwp-json\u002Fslim-seo\u002Fmeta-tags\u002Fai`\n- **Method:** `POST` (Typically used for generation\u002Fprocessing endpoints in Slim SEO)\n- **Vulnerable Parameter:** `object.ID` (likely passed as part of a JSON payload)\n- **Required Authentication:** Authenticated user with `edit_posts` capability (Contributor level).\n- **Impact:** Disclosure of sensitive information from private, draft, pending, or password-protected posts and pages across the entire WordPress site.\n\n## 3. Code Flow\n1. **Request Entry:** An authenticated Contributor sends a request to `\u002Fwp-json\u002Fslim-seo\u002Fmeta-tags\u002Fai`.\n2. **Authorization Check:** The REST API router executes the `permission_callback`. It checks `current_user_can( 'edit_posts' )`. This returns `true` for Contributors.\n3. **Controller Execution:** The request proceeds to the `generate` function (likely within an AI-related controller class in `src\u002F`).\n4. **Parameter Handling:** The controller extracts the `object.ID` from the request object.\n5. **Data Retrieval:** The controller calls `SlimSEO\\Data::get_post_content( $post_id )` (inferred class\u002Fmethod).\n6. **Information Sink:** Inside `get_post_content()`, the plugin calls `get_post( $post_id )`. WordPress's `get_post()` retrieves the post object regardless of the current user's read permissions.\n7. **AI Processing:** The raw `post_content` is sent to the configured AI provider (OpenAI\u002FAnthropic) to generate a summary\u002Fmeta tag.\n8. **Response:** The AI-generated summary of the private content is returned in the HTTP response to the Contributor.\n\n## 4. Nonce Acquisition Strategy\nThe endpoint is a WordPress REST API route. Standard WordPress REST API security requires the `X-WP-Nonce` header for authenticated requests.\n\n1. **User Role:** Contributor.\n2. **Strategy:** Log in as the Contributor and navigate to the WordPress Dashboard (`\u002Fwp-admin\u002F`). The REST API nonce (`wp_rest`) is globally available in the `wpApiSettings` JavaScript object on most admin pages.\n3. **Execution:**\n   - Use `browser_navigate` to go to `\u002Fwp-admin\u002F`.\n   - Use `browser_eval` to extract the nonce: \n     ```javascript\n     window.wpApiSettings.nonce\n     ```\n   - This nonce is valid for the `wp_rest` action, which authorizes requests to `\u002Fwp-json\u002F`.\n\n## 5. Exploitation Strategy\n### Step 1: Discover Target Post ID\nIdentify the ID of a private post authored by the Administrator. This can often be done by brute-forcing IDs or viewing the sitemap if IDs are leaked there (though private posts usually aren't). For the PoC, we will create a post and note its ID.\n\n### Step 2: The Attack Request\nAs a Contributor, send the following request:\n\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fslim-seo\u002Fmeta-tags\u002Fai`\n- **Method:** `POST`\n- **Headers:**\n  - `Content-Type: application\u002Fjson`\n  - `X-WP-Nonce: [EXTRACTED_NONCE]`\n- **Body:**\n  ```json\n  {\n    \"object\": {\n      \"ID\": [PRIVATE_POST_ID]\n    },\n    \"type\": \"description\"\n  }\n  ```\n  *(Note: The `type` parameter is inferred from the plugin's \"Meta Tags\" functionality which generates titles and descriptions).*\n\n### Step 3: Analyze Response\nA successful exploit will return a `200 OK` response with a JSON body containing a \"content\" or \"result\" field. This field will contain a summary of the private post's content.\n\n## 6. Test Data Setup\n1. **Create Administrator Post:** \n   ```bash\n   wp post create --post_type=post --post_title=\"Top Secret Strategy\" --post_content=\"The password to the vault is 'Blue-Monkey-42'. We launch the product on Friday at midnight.\" --post_status=private --post_author=1\n   ```\n   *Note the resulting ID (e.g., 123).*\n2. **Create Contributor User:**\n   ```bash\n   wp user create attacker attacker@example.com --role=contributor --user_pass=password123\n   ```\n3. **Configure Slim SEO AI (Optional\u002FMock):**\n   The AI feature might require an API key to be set in Slim SEO settings. If the environment does not have internet access, the researcher may need to mock the AI response or check if the plugin fails *after* retrieving the content but *before* calling the API (though the vulnerability usually results in the data being sent to the AI service).\n\n## 7. Expected Results\n- **Request:** Contributor sends `POST` to `\u002Fwp-json\u002Fslim-seo\u002Fmeta-tags\u002Fai` with `object.ID=123`.\n- **Authorization:** `permission_callback` returns `true`.\n- **Response:** JSON response containing a summary like: `\"Generated description: Strategy involving vault password 'Blue-Monkey-42' and a Friday launch.\"`\n- **Security Failure:** The Contributor has successfully retrieved the \"gist\" of a private post owned by the Admin.\n\n## 8. Verification Steps\n1. **Confirm Post Status:** Use WP-CLI to ensure the post is indeed private.\n   ```bash\n   wp post get [ID] --field=post_status\n   ```\n2. **Verify User Permissions:** Ensure the Contributor cannot view the post normally.\n   - Try to access `\u002F?p=[ID]` as the Contributor via `browser_navigate`.\n   - Result should be a 404 or \"Post not found\".\n3. **Confirm Data Leakage:** Compare the content returned by the REST API with the original secret content.\n\n## 9. Alternative Approaches\nIf the `object.ID` parameter is not nested:\n- Try `{\"ID\": 123}`\n- Try `GET \u002Fwp-json\u002Fslim-seo\u002Fmeta-tags\u002Fai?object[ID]=123`\n- Check for other AI endpoints mentioned in `js\u002Fsettings-ai.js`: `\u002Fslim-seo\u002Fbulk-ai\u002Fchunk` or `\u002Fslim-seo\u002Fai\u002Fmodels` for similar authorization flaws.\n\n*Note: The core vulnerability is the lack of `if ( ! current_user_can( 'read_post', $post_id ) )` in the permission callback or the handler.*","gemini-3-flash-preview","2026-07-25 12:38:19","2026-07-25 12:38:40",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.9.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fslim-seo\u002Ftags\u002F4.9.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fslim-seo.4.9.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fslim-seo\u002Ftags\u002F4.9.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fslim-seo.4.9.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fslim-seo\u002Ftags"]