CVE-2026-12408

Name of the Vulnerable Software and Affected Versions Slim SEO versions prior to 4.9.9

Description An issue exists in the /wp-json/slim-seo/meta-tags/ai REST API endpoint. The permission callback only verifies a top-level edit posts capability and fails to check if the user has read access to the specific post identified by the object.ID parameter. Consequently, the generate() function passes the attacker-controlled post ID to Data::get post content(), which utilizes get post() to retrieve content regardless of its status or ownership. This allows authenticated users with Contributor-level access or higher to obtain AI-generated summaries of unauthorized content, including private posts, drafts, pending, future, and password-protected posts authored by other users.

Recommendations Update Slim SEO to version 4.9.9 or later. As a temporary mitigation, restrict access to the /wp-json/slim-seo/meta-tags/ai endpoint for users with Contributor-level permissions.