{
 "id": "WPSEC-2026-2008",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2008/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2008/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2008/index.md",
 "title": "SEOPress <= 10.3 - Authenticated (Editor+) Sensitive Information Exposure via Custom Field Dynamic Variables",
 "description": "The SEOPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the %%_cf_<key>%% and %%_ucf_<key>%% dynamic variables in all versions up to, and including, 10.3, due to the plugin resolving any post, term or user meta key, including protected and credential-like keys, and printing the value into the page title, meta description and social meta tags. This makes it possible for authenticated attackers, with Editor-level access and above, to expose protected metadata of other users, such as an administrator's user meta, by adding these variables to the SEO metadata of content those users wrote.",
 "plugin": {
  "slug": "wp-seopress",
  "name": "SEOPress",
  "full_name": "SEOPress – AI SEO Plugin & On-site SEO",
  "wordpress_org": "https://wordpress.org/plugins/wp-seopress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-seopress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-seopress"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "10.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 10.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "10.4",
 "remediation": "Update to 10.4 or later.",
 "fix_released": "2026-10-29T08:17:36+00:00",
 "published": "2026-10-30T08:47:55+00:00",
 "updated": "2026-10-29T17:46:35.985956+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2008/",
  "https://plugins.svn.wordpress.org/wp-seopress/tags/10.4/",
  "https://wordpress.org/plugins/wp-seopress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-seopress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}