CVE-2026-16957

Name of the Vulnerable Software and Affected Versions Slim SEO versions prior to 4.9.11

Description A post-meta preview feature fails to restrict access to posts that the user is authorized to edit, verifying only read access. This allows users with the Contributor role to read arbitrary post meta of published posts they do not own, including password-protected posts and posts of non-public post types. This disclosure may include protected and private keys.

Recommendations Update Slim SEO to version 4.9.11 or later.