Search Atlas SEO <= 2.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure of Plugin Auth Token
- ID
- WPSEC-2026-1977
- Plugin
- Search Atlas SEO – OTTO AI SEO Automation for WordPress (metasync)
- Affected
- all versions before 2.7.4
- Remediation
- Update to 2.7.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Search Atlas SEO on WPSec AttackSurface
- Fix released
- Published
Description
The Search Atlas SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via the plugin Settings page and the 'metasync_get_plugin_auth_token' and 'metasync_refresh_plugin_auth_token' AJAX actions in all versions up to, and including, 2.7.3. This is due to the plugin printing the full Plugin Auth Token into the Settings page and returning it in AJAX responses, while checking only the plugin's role-based access setting and not the manage_options capability. This makes it possible for authenticated attackers whose role an administrator has granted access to the plugin (any role, down to Subscriber, when 'All Roles' is selected) to read or rotate the site's Plugin Auth Token. That token gives administrator-level access to the plugin's MCP server and its API-key-protected REST endpoints, including content publishing.
References
- https://wpsec.com/vuln/WPSEC-2026-1977/
- https://plugins.svn.wordpress.org/metasync/tags/2.7.4/
- https://wordpress.org/plugins/metasync/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS