{
 "id": "WPSEC-2026-1977",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1977/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1977/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1977/index.md",
 "title": "Search Atlas SEO <= 2.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure of Plugin Auth Token",
 "description": "The Search Atlas SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via the plugin Settings page and the 'metasync_get_plugin_auth_token' and 'metasync_refresh_plugin_auth_token' AJAX actions in all versions up to, and including, 2.7.3. This is due to the plugin printing the full Plugin Auth Token into the Settings page and returning it in AJAX responses, while checking only the plugin's role-based access setting and not the manage_options capability. This makes it possible for authenticated attackers whose role an administrator has granted access to the plugin (any role, down to Subscriber, when 'All Roles' is selected) to read or rotate the site's Plugin Auth Token. That token gives administrator-level access to the plugin's MCP server and its API-key-protected REST endpoints, including content publishing.",
 "plugin": {
  "slug": "metasync",
  "name": "Search Atlas SEO",
  "full_name": "Search Atlas SEO – OTTO AI SEO Automation for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/metasync/",
  "advisories_url": "https://wpsec.com/vuln/plugin/metasync/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/metasync"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.7.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.7.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.7.4",
 "remediation": "Update to 2.7.4 or later.",
 "fix_released": "2026-10-28T23:41:46+00:00",
 "published": "2026-10-29T23:45:53+00:00",
 "updated": "2026-10-29T17:42:49.226444+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1977/",
  "https://plugins.svn.wordpress.org/metasync/tags/2.7.4/",
  "https://wordpress.org/plugins/metasync/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/metasync",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}