# Search Atlas SEO <= 2.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure of Plugin Auth Token

- **ID:** WPSEC-2026-1977
- **Plugin:** Search Atlas SEO – OTTO AI SEO Automation for WordPress (`metasync`), https://wordpress.org/plugins/metasync/
- **Affected versions:** all versions before 2.7.4
- **Fixed in:** 2.7.4 (Update to 2.7.4 or later.)
- **Severity:** Medium 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/metasync
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1977/

## Description

The Search Atlas SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via the plugin Settings page and the 'metasync_get_plugin_auth_token' and 'metasync_refresh_plugin_auth_token' AJAX actions in all versions up to, and including, 2.7.3. This is due to the plugin printing the full Plugin Auth Token into the Settings page and returning it in AJAX responses, while checking only the plugin's role-based access setting and not the manage_options capability. This makes it possible for authenticated attackers whose role an administrator has granted access to the plugin (any role, down to Subscriber, when 'All Roles' is selected) to read or rotate the site's Plugin Auth Token. That token gives administrator-level access to the plugin's MCP server and its API-key-protected REST endpoints, including content publishing.

## References

- https://wpsec.com/vuln/WPSEC-2026-1977/
- https://plugins.svn.wordpress.org/metasync/tags/2.7.4/
- https://wordpress.org/plugins/metasync/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1977/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.