CVE-2026-15947: CWE-862 Missing Authorization in shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation for WordPress
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.
AI Analysis
Technical Summary
CVE-2026-15947 is a missing authorization vulnerability (CWE-862) in the Metasync plugin for WordPress, specifically in the save_instant_indexing_settings() function. This function is hooked to admin_init and only verifies the presence of a POST parameter before updating the 'metasync_options_instant_indexing' option with attacker-supplied data. There is no check for user capabilities (e.g., current_user_can()) or nonce verification, enabling authenticated users with Subscriber-level privileges or higher to alter Google Instant Indexing post-type settings.
Potential Impact
An attacker with authenticated access at the Subscriber level or above can modify the configuration controlling which post types are automatically submitted to Google's Instant Indexing service. This unauthorized modification could affect the site's SEO behavior by changing indexing settings without proper authorization. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for unauthorized changes to the 'metasync_options_instant_indexing' option. Consider disabling or limiting access to the affected plugin if possible.
CVE-2026-15947: CWE-862 Missing Authorization in shahrukhlinkgraph Search Atlas SEO – OTTO AI SEO Automation for WordPress
Description
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.
CVSS v3.1
Score 4.3medium
Affected software
shahrukhlinkgraph
Search Atlas SEO – OTTO AI SEO Automation for WordPress
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15947 is a missing authorization vulnerability (CWE-862) in the Metasync plugin for WordPress, specifically in the save_instant_indexing_settings() function. This function is hooked to admin_init and only verifies the presence of a POST parameter before updating the 'metasync_options_instant_indexing' option with attacker-supplied data. There is no check for user capabilities (e.g., current_user_can()) or nonce verification, enabling authenticated users with Subscriber-level privileges or higher to alter Google Instant Indexing post-type settings.
Potential Impact
An attacker with authenticated access at the Subscriber level or above can modify the configuration controlling which post types are automatically submitted to Google's Instant Indexing service. This unauthorized modification could affect the site's SEO behavior by changing indexing settings without proper authorization. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for unauthorized changes to the 'metasync_options_instant_indexing' option. Consider disabling or limiting access to the affected plugin if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-16T12:58:02.958Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aae3e0255bf5e2cf54897ce
Added to database: 09/19/2026, 07:47:14 UTC
Last enriched: 09/19/2026, 08:02:46 UTC
Last updated: 09/19/2026, 22:12:52 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.