The Slim SEO WordPress plugin versions prior to 4.9.11 contain an authorization bypass vulnerability (CWE-639) where the post-meta preview feature does not restrict access to posts the user is authorized to edit. Instead, it only checks for read access, enabling users with the Contributor role to access arbitrary post meta data, including protected and private keys, from published posts they do not own. This includes data from password-protected posts and posts of non-public post types. The vulnerability has a CVSS 3.1 base score of 2.7, indicating low impact, and there are no known exploits in the wild. No official patch or remediation level has been published yet.

Users with the Contributor role can read sensitive post meta information they should not have access to, including protected and private keys from posts they do not own. This exposure is limited to confidentiality impact only, with no integrity or availability impact reported. The vulnerability affects published posts, including password-protected and non-public post types.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role permissions or limit access to the Slim SEO plugin features to trusted users only.