CVE-2026-104001: CWE-94 Improper Control of Generation of Code ('Code Injection') in rilwis Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated

CVE-2026-104001 is a code injection vulnerability (CWE-94) in the Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated for WordPress. The flaw allows authenticated attackers with subscriber-level privileges to inject and execute arbitrary shortcodes by saving malicious payloads in their Biographical Info field through the REST API or wp-admin profile page. The injected shortcode executes on any unauthenticated front-end request that resolves the author's description, for example, via the ?author= query parameter when auto_redirection is disabled. This vulnerability affects all plugin versions up to and including 4.11.1.

An attacker with subscriber-level access can execute arbitrary shortcodes on the front-end of the affected WordPress site. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N). The vulnerability does not allow privilege escalation or denial of service but can be used to perform unauthorized actions within the scope of shortcode execution.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict subscriber-level user capabilities where possible and consider disabling the use of the ?author= query parameter or the auto_redirection feature to reduce exposure. Validate and sanitize user input fields such as Biographical Info to prevent shortcode injection.