The vulnerability in Slim SEO before version 4.9.11 allows a user with the Contributor role to preview post metadata without enforcing permission checks beyond read access. This omission, a CWE-200 Information Exposure weakness accompanied by an improper authorization flaw (CWE-285), lets contributors read arbitrary post‑meta fields—including protected or private keys—from any published post they do not own, as well as from password‑protected or non‑public post types. The result is a confidentiality breach of potentially sensitive information stored in post meta.

Any WordPress site that runs the Slim SEO plugin older than 4.9.11 and supports contributor accounts is affected. The flaw is product‑specific and applies to all installations of the plugin in that version range.

While no CVSS score is available and the EPSS score is not provided, the exposure of arbitrary meta fields is a moderate to high risk for organizations that store sensitive data as post meta. The attack vector is a web request to the preview endpoint, requiring only a contributor‑level authentication token; no higher privileges or local access are needed, and no remote code execution is possible. The vulnerability is not listed in CISA KEV, but the confidentiality impact warrants prompt remediation.