The vulnerability in Slim SEO before version 4.9.11 allows a user with the Contributor role to preview post metadata without enforcing permission checks beyond read access. This omission, a CWE-639 Authorization Bypass Through User-Controlled Key weakness, lets contributors read arbitrary post‑meta fields—including protected or private keys—from any published post they do not own, as well as from password‑protected or non‑public post types. The result is a confidentiality breach of potentially sensitive information stored in post meta.

Any WordPress site that runs the Slim SEO plugin older than 4.9.11 and supports contributor accounts is affected. The flaw is product‑specific and applies to all installations of the plugin in that version range.

The CVSS score of 2.7 indicates a low severity, and the EPSS score is < 1%, suggesting a very low probability of exploitation. The exposure of arbitrary meta fields is still a concern for organizations that store sensitive data as post meta. The attack vector involves a web request to the preview endpoint and requires only contributor‑level authentication; no higher privileges or local access are needed, and no remote code execution is possible. The vulnerability is not listed in CISA KEV, but the confidentiality impact warrants prompt remediation.