{"id":"CVE-2026-104001","kind":"vulnerability","aliases":["CVE-2026-104001"],"related":[],"title":"Slim SEO WordPress plugin: subscribers can run arbitrary shortcodes","description":"The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.","summary":"The Slim SEO WordPress plugin up to and including 4.11.1 passes unvalidated author data to do_shortcode. A subscriber can save a shortcode payload in their Biographical Info field, and it runs on front-end author pages for any visitor.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Slim SEO plugin version in wp-admin under Plugins; affected versions are up to and including `4.11.1`.\n- Look for user accounts with the Subscriber role that have unusual content in their Biographical Info field.","fix":"- Update the Slim SEO plugin to a version later than `4.11.1`; the sources do not name the exact fixed release, so check the plugin changelog.\n- Until patched, remove unknown Subscriber-role accounts and review Biographical Info values for shortcode syntax.","status":"open","published_at":"2026-10-16T06:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:18:40+00:00","updated_at":"2026-10-25T04:18:40+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:18:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Slim SEO plugin to a version later than `4.11.1`; the sources do not name the exact fixed release, so check the plugin changelog.\n- Until patched, remove unknown Subscriber-role accounts and review Biographical Info values for shortcode syntax.","reach":"internet","title":"Slim SEO WordPress plugin: subscribers can run arbitrary shortcodes","impact":"medium","summary":"The Slim SEO WordPress plugin up to and including 4.11.1 passes unvalidated author data to do_shortcode. A subscriber can save a shortcode payload in their Biographical Info field, and it runs on front-end author pages for any visitor.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"arbitrary shortcodes run on public author pages for every visitor","analyst_note":"","how_to_check":"- Check the installed Slim SEO plugin version in wp-admin under Plugins; affected versions are up to and including `4.11.1`.\n- Look for user accounts with the Subscriber role that have unusual content in their Biographical Info field.","needs_analyst":false,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Slim SEO WordPress plugin at version 4.11.1 or earlier are exposed. The risk comes from any registration path that gives users the Subscriber role, since those users can write to their own profile bio. Sites without this plugin, or with it patched, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3480,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104001':12A,15A '-2026':11A,14A '4.11.1':33B,91C 'access':126C 'action':103C 'admin':157C 'ai':69C 'allow':98C 'api':153C 'arbitrari':8A,81C,131C 'attack':121C 'authent':120C 'author':36B,60B,174C,182C 'auto':186C 'autom':74C 'biograph':50B,147C 'cve':10A,13A 'data':37B 'descript':176C 'disabl':189C 'due':94C 'end':59B,169C 'execut':83C,101C,130C,163C 'fast':73C 'field':52B,149C 'front':58B,168C 'front-end':57B,167C 'host':19B 'includ':32B,90C 'info':51B,148C 'level':125C,136C 'lightweight':72C 'make':116C 'need':138C 'packag':16B 'page':61B,159C 'paramet':184C 'pass':34B 'payload':47B,143C 'plugin':4A,23B,28B,71C,75C 'possibl':118C 'profil':158C 'proper':107C 'queri':183C 'redirect':187C 'request':170C,179C 'resolv':172C 'rest':152C 'run':7A,55B,112C 'save':44B,140C 'self':18B 'self-host':17B 'seo':2A,26B,68C,70C 'shortcod':9A,40B,46B,82C,114C,132C,142C,161C 'slim':1A,25B,67C 'softwar':97C 'subscrib':5A,42B,124C,135C 'subscriber-level':123C,134C 'unauthent':166C 'unvalid':35B 'use':180C 'user':99C,137C 'valid':108C 'valu':110C 'version':86C 'via':150C 'visitor':64B 'vulner':79C 'wordpress':3A,20B,22B,27B,77C 'wordpress-plugin':21B 'wp':156C 'wp-admin':155C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Slim SEO WordPress plugin at version 4.11.1 or earlier are exposed. The risk comes from any registration path that gives users the Subscriber role, since those users can write to their own profile bio. Sites without this plugin, or with it patched, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104001","severity":null,"published_at":"2026-10-16T06:17:05+00:00","modified_at":"2026-10-16T15:17:02+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}