SEOPress <= 10.3 - Authenticated (Editor+) Sensitive Information Exposure via Custom Field Dynamic Variables
- ID
- WPSEC-2026-2008
- Plugin
- SEOPress – AI SEO Plugin & On-site SEO (wp-seopress)
- Affected
- all versions before 10.4
- Remediation
- Update to 10.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- SEOPress on WPSec AttackSurface
- Fix released
- Published
Description
The SEOPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the %%_cf_<key>%% and %%_ucf_<key>%% dynamic variables in all versions up to, and including, 10.3, due to the plugin resolving any post, term or user meta key, including protected and credential-like keys, and printing the value into the page title, meta description and social meta tags. This makes it possible for authenticated attackers, with Editor-level access and above, to expose protected metadata of other users, such as an administrator's user meta, by adding these variables to the SEO metadata of content those users wrote.
References
- https://wpsec.com/vuln/WPSEC-2026-2008/
- https://plugins.svn.wordpress.org/wp-seopress/tags/10.4/
- https://wordpress.org/plugins/wp-seopress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS