CVE-2026-104001: Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta

Q: Which users can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker can save a shortcode payload in their own Biographical Info field using either the REST API or the wp-admin profile page.

Q: When does the injected shortcode execute?

It executes when an unauthenticated front-end request resolves the affected author's description. One described path is an author request using the ?author= query parameter when auto_redirection is disabled.

Q: Does exploitation require administrator access or user interaction?

No administrator access is required; Subscriber access is sufficient. The CVSS vector indicates no user interaction is required.

Q: How can I assess whether my site may be exposed?

Check whether Slim SEO is installed at version 4.11.1 or earlier and whether untrusted users can hold Subscriber-or-higher accounts. Also review whether author-description pages can be resolved publicly, including through ?author= requests when auto_redirection is disabled.

Published Oct 16, 2026

Updated

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when autoredirection is disabled.

Affected Software

1 affected component

Slim SEO Slim SEO WordPress plugin<=4.11.1

Event History

Oct 16, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker can save a shortcode payload in their own Biographical Info field using either the REST API or the wp-admin profile page.

When does the injected shortcode execute?

It executes when an unauthenticated front-end request resolves the affected author's description. One described path is an author request using the ?author= query parameter when auto_redirection is disabled.

Does exploitation require administrator access or user interaction?

No administrator access is required; Subscriber access is sufficient. The CVSS vector indicates no user interaction is required.

How can I assess whether my site may be exposed?

Check whether Slim SEO is installed at version 4.11.1 or earlier and whether untrusted users can hold Subscriber-or-higher accounts. Also review whether author-description pages can be resolved publicly, including through ?author= requests when auto_redirection is disabled.

CVE-2026-104001: Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

When does the injected shortcode execute?

Does exploitation require administrator access or user interaction?

How can I assess whether my site may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

When does the injected shortcode execute?

Does exploitation require administrator access or user interaction?

How can I assess whether my site may be exposed?