Technical impact
Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions. The vulnerability is an Insecure Direct Object References flaw in WordPress Slim SEO, classified as CWE-639. An attacker who can guess or manipulate identifiers may read or modify data belonging to other. No remote code execution or privilege escalation is reported, but the defect permits unauthorized data disclosure.
Affected Systems
The affected product is the WordPress Slim SEO plugin developed by Anh Tran. Any installation of the plugin with a version of 4.10.0 or earlier is vulnerableThe vulnerability is an Insecure Direct Object References flaw in WordPress Slim SEO, classified as CWE‑639. An attacker who can guess or manipulate identifiers may read or modify data belonging to other. No remote code execution or privilege escalation is reported, but the defect permits unauthorized data disclosure.
Risk and Exploitability
The CVSS score is 4.3, indicating low severity. The EPSS score is < 1%, which suggests a very low probability of exploitation. The vulnerability requires the attacker to manipulate request parameters to obtain IDs; the exact prerequisites are not detailed in the description, so the ease of exploitation remains uncertain.
