---
id: "CVE-2026-104001"
kind: "vulnerability"
aliases: ["CVE-2026-104001"]
title: "Slim SEO WordPress plugin: subscribers can run arbitrary shortcodes"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-16T06:17:05+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:18:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104001", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Slim SEO WordPress plugin: subscribers can run arbitrary shortcodes

The Slim SEO WordPress plugin up to and including 4.11.1 passes unvalidated author data to do_shortcode. A subscriber can save a shortcode payload in their Biographical Info field, and it runs on front-end author pages for any visitor.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Slim SEO plugin version in wp-admin under Plugins; affected versions are up to and including `4.11.1`.
- Look for user accounts with the Subscriber role that have unusual content in their Biographical Info field.

## Fix

- Update the Slim SEO plugin to a version later than `4.11.1`; the sources do not name the exact fixed release, so check the plugin changelog.
- Until patched, remove unknown Subscriber-role accounts and review Biographical Info values for shortcode syntax.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104001

## From the sources

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_