Medium severity · published Feb 28, 2023
CVE-2023-1026
WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory'
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to get post listings by category as long as those posts are published. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
WP Meta SEO · joomunited
through 4.5.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-1026
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-1026
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2870465/wp-meta-seo/trunk?contextall=1&old=2869205&old_path=%2Fwp-meta-seo%2Ftrunk#file2
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2870465%40wp-meta-seo&new=2870465%40wp-meta-seo&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/978d5715-7993-4f89-8d69-895467633bfb?source=cve
Broken Link
https://www.wordfence.com/threat-intel/vulnerabilities/id/978d5715-7993-4f89-8d69-895467633bfb
More from WP Meta SEO
8.8
CVE-2023-1381
WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization
8.8
CVE-2023-0875
WP Meta SEO < 4.5.3 - Subscriber+ SQLi
7.2
CVE-2026-9643
WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
6.4
CVE-2026-11370
WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
6.1
CVE-2023-6961
WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header