CVE-2026-104001: Slim SEO WordPress Plugin RCE Vulnerability

CVE-2026-104001 Overview

The Slim SEO – AI SEO Plugin for WordPress contains an arbitrary shortcode execution vulnerability affecting all versions up to and including 4.11.1. The flaw resides in logic that passes user-controlled profile data to do_shortcode without validation. Authenticated attackers with Subscriber-level access can store shortcode payloads in their Biographical Info field through the REST API or the wp-admin profile page. The shortcodes execute when unauthenticated visitors trigger front-end requests that resolve the author's description, including requests using the ?author= query parameter when auto_redirection is disabled. The weakness is classified under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Subscriber-level accounts can inject arbitrary shortcodes that execute in unauthenticated front-end contexts, enabling abuse of any registered shortcode on the site.

Affected Products

Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated (WordPress plugin)
All versions through 4.11.1
Fixed in version 4.11.2

Discovery Timeline

2026-10-16 - CVE-2026-104001 published to the National Vulnerability Database
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-104001

Vulnerability Analysis

The Slim SEO plugin generates meta description content by reading the Biographical Info field from author profiles. The plugin passes that stored value into WordPress's do_shortcode function during meta tag rendering. Because WordPress permits all registered user roles, including Subscribers, to edit their own profile description, any authenticated low-privilege account can insert shortcode syntax that the plugin later evaluates. The relevant logic lives in src/MetaTags/Data.php and src/MetaTags/Helper.php within the 4.11.0 branch.

Execution occurs server-side during unauthenticated page rendering, not inside the author's own dashboard. The impact depends on which shortcodes are registered by the WordPress core, active themes, and other plugins on the target site.

Root Cause

The plugin treats profile description text as trusted markup suitable for shortcode expansion. No capability check, allowlist, or stripping routine is applied before do_shortcode is invoked on the author description value. This violates the principle that content authored by low-privilege users must not be interpreted as code in a higher-trust rendering path.

Attack Vector

An attacker registers or compromises a Subscriber-level account on a WordPress site running the vulnerable plugin. The attacker then updates their own profile Biographical Info with a shortcode payload, either through wp-admin/profile.php or the WordPress REST API users endpoint. The attacker next triggers a public URL that renders meta tags for that author, such as https://victim.example/?author=<id> when the plugin's auto_redirection option is disabled. The front-end render path invokes do_shortcode on the stored description, executing the attacker-supplied shortcode without authentication on the visitor side.

See the GitHub Pull Request #296 and the WordPress Changeset 4.11.0 to 4.11.2 for the upstream fix.

Detection Methods for CVE-2026-104001

Indicators of Compromise

Unexpected shortcode syntax, such as [ and ] bracketed tags, stored in the description user meta of Subscriber or Contributor accounts.
Front-end requests to ?author=<id> URLs from external IPs preceding or following profile updates by low-privilege accounts.
REST API calls to /wp-json/wp/v2/users/me or /wp-json/wp/v2/users/<id> that modify the description field with shortcode content.
New Subscriber account registrations followed within minutes by profile edits containing bracket characters.

Detection Strategies

Query the wp_usermeta table for meta_key = 'description' values containing [ or ] characters, especially for users with role subscriber or contributor.
Inspect web server access logs for POST requests to profile.php or /wp-json/wp/v2/users/ from accounts that have never previously edited their profile.
Correlate author archive page views with recent profile changes to identify probing of injected shortcodes.

Monitoring Recommendations

Enable WordPress audit logging for user profile updates and REST API user-endpoint writes.
Alert on installations of the Slim SEO plugin at versions <= 4.11.1.
Monitor outbound HTTP connections from the web server that correlate with shortcode-driven actions, such as mail sends or remote fetches.

How to Mitigate CVE-2026-104001

Immediate Actions Required

Update the Slim SEO plugin to version 4.11.2 or later on all WordPress sites.
Audit existing user description fields for shortcode payloads and sanitize or remove any that are present.
Review Subscriber and Contributor accounts for unauthorized registrations and disable or delete suspicious users.
Restrict open user registration where business requirements allow.

Patch Information

The maintainers resolved the issue in Slim SEO 4.11.2. The fix removes the unsafe shortcode expansion on author description content. Review the Wordfence Vulnerability Report and the WordPress Changeset 4.11.0 to 4.11.2 for implementation details.

Workarounds

Disable the Slim SEO plugin until the update to 4.11.2 can be deployed.
Enable the plugin's auto_redirection option so that ?author= requests redirect away from the vulnerable render path.
Set users_can_register to false in WordPress general settings to block anonymous Subscriber account creation.
Apply a web application firewall rule that strips bracketed shortcode syntax from description fields submitted via profile.php and the REST API users endpoint.

bash

# Verify installed Slim SEO version and update via WP-CLI
wp plugin get slim-seo --field=version
wp plugin update slim-seo --version=4.11.2

# Identify user descriptions containing shortcode brackets
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key='description' AND (meta_value LIKE '%[%' OR meta_value LIKE '%]%');"

# Disable open registration as a defense-in-depth control
wp option update users_can_register 0