https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 15:28:07 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-15947 <p>The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST[&#39;submit&#39;] before writing attacker-supplied $_POST[&#39;metasync_post_types&#39;] into the site-wide &#39;metasync_options_instant_indexing&#39; option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site&#39;s Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google&#39;s Instant Indexing service.</p> <p>The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST[&#39;submit&#39;] before writing attacker-supplied $_POST[&#39;metasync_post_types&#39;] into the site-wide &#39;metasync_options_instant_indexing&#39; option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site&#39;s Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google&#39;s Instant Indexing service.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-15947 https://vulnerability.circl.lu/vuln/ghsa-vpqr-9v4h-mgff <p>The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST[&#39;submit&#39;] before writing attacker-supplied $_POST[&#39;metasync_post_types&#39;] into the site-wide &#39;metasync_options_instant_indexing&#39; option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site&#39;s Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google&#39;s Instant Indexing service.</p> <p>The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST[&#39;submit&#39;] before writing attacker-supplied $_POST[&#39;metasync_post_types&#39;] into the site-wide &#39;metasync_options_instant_indexing&#39; option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site&#39;s Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google&#39;s Instant Indexing service.</p> https://vulnerability.circl.lu/vuln/ghsa-vpqr-9v4h-mgff