The Slim SEO plugin for WordPress contains an information disclosure vulnerability (CWE-200) in all versions up to and including 4.9.8. The vulnerability exists in the /wp-json/slim-seo/meta-tags/ai REST API endpoint, where the permission_callback only checks if the user has the edit_posts capability, but does not verify if the user has read access to the specific post identified by the object.ID parameter. Consequently, authenticated users with Contributor-level permissions or higher can retrieve AI-generated summaries of the raw post_content of arbitrary posts, including those that are private, drafts, pending, future, or password-protected, authored by other users. This occurs because the generate function passes the attacker-controlled post ID to Data::get_post_content(), which calls get_post() without regard to post status or ownership, exposing sensitive content in the HTTP response.

An attacker with Contributor-level or higher authenticated access can obtain sensitive information from posts they are not authorized to view. This includes private, draft, pending, future, and password-protected posts authored by other users. The exposure is limited to the AI-generated summaries of the raw post content, which may contain sensitive or confidential information. There is no indication of integrity or availability impact. The CVSS v3.1 base score is 4.3, reflecting a low complexity attack with limited confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher user access carefully and monitor usage of the /wp-json/slim-seo/meta-tags/ai REST API endpoint. Avoid granting edit_posts capability to untrusted users. Follow vendor updates for an official patch or temporary workaround.