CVE-2026-15947: Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings() function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of $POST['submit'] before writing attacker-supplied $POST['metasyncposttypes'] into the site-wide 'metasyncoptionsinstantindexing' option via updateoption(); no currentusercan()/currentuserhaspluginaccess() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Metasync plugin for WordPressto a version that resolves this vulnerability.Fixed in 2.6.23
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. No administrative capability is required.
What must an attacker be able to do to change the configuration?
The attacker needs a valid authenticated WordPress account and must submit a request containing the submit parameter and an attacker-controlled metasync_post_types value. The vulnerable handler does not require a capability check or nonce verification.
What can be changed through this vulnerability?
An attacker can alter the site-wide metasync_options_instant_indexing setting, specifically the post types configured for automatic submission to Google's Instant Indexing service. The provided information does not indicate that other plugin or WordPress settings can be modified through this issue.
Are default installations exposed?
The issue affects Metasync versions up to and including 2.6.23 because the vulnerable function runs on the admin_init hook. Exploitation still requires an authenticated account with at least Subscriber access.