The Slim SEO plugin for WordPress versions up to and including 4.9.8 contains an unauthorized private content disclosure vulnerability via the /wp-json/slim-seo/meta-tags/ai REST API endpoint. The endpoint's permission_callback only checks if the user has the edit_posts capability but does not verify if the user has read access to the specific post identified by the object.ID parameter. Consequently, the generate function passes the attacker-controlled post ID to Data::get_post_content(), which calls get_post() without regard to post status or ownership. This flaw enables authenticated users with Contributor-level permissions or higher to access AI-generated summaries of the raw post content of arbitrary posts they should not be able to view, including private, draft, pending, future, and password-protected posts.

An attacker with Contributor-level or higher privileges can access sensitive content from posts they are not authorized to view, including private and unpublished posts. This exposure of sensitive information can lead to unauthorized disclosure of confidential or unpublished content. The vulnerability does not affect integrity or availability but results in a confidentiality breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to limit Contributor-level access and above to trusted users only. Monitor for updates from the plugin vendor regarding a security patch and apply it promptly once released.