# SEOPress <= 10.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Robots Meta, Redirection and Image Attribute Modification via Bulk Actions

- **ID:** WPSEC-2026-2009
- **Plugin:** SEOPress – AI SEO Plugin & On-site SEO (`wp-seopress`), https://wordpress.org/plugins/wp-seopress/
- **Affected versions:** all versions before 10.4
- **Fixed in:** 10.4 (Update to 10.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-seopress
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2009/

## Description

The SEOPress plugin for WordPress is vulnerable to Insecure Direct Object Reference via the bulk actions on the post, term and Media Library list tables in all versions up to, and including, 10.3, due to missing per-object capability checks in the bulk action handlers (noindex, index, nofollow, follow, redirection enable/disable, add to instant indexing queue, and generate alt text from filename). The robots handlers also wrote the same value to the term meta of the term sharing each submitted numeric ID. This makes it possible for authenticated attackers, with Contributor-level access and above, to submit the IDs of posts they cannot edit, and so set them to noindex or nofollow, toggle their redirections or add them to the instant indexing queue. Attackers with Author-level access and above can also overwrite the alt text and other attributes of images uploaded by other users.

## References

- https://wpsec.com/vuln/WPSEC-2026-2009/
- https://plugins.svn.wordpress.org/wp-seopress/tags/10.4/
- https://wordpress.org/plugins/wp-seopress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2009/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.