CVE-2026-15947

🗓️ 19 Sep 2026 08:16:53Reported by [email protected]Type

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the ad...

Reporter	Title	Published	Views	Family All 3
CVE	CVE-2026-15947	19 Sep 202607:43	–	cve
Cvelist	CVE-2026-15947 Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter	19 Sep 202607:43	–	cvelist
EUVD	EUVD-2026-83572	19 Sep 202609:32	–	euvd

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/metasync/tags/2.6.16/admin/class-metasync-admin.php
plugins	www.plugins.trac.wordpress.org/browser/metasync/tags/2.6.16/admin/class-metasync-admin.php
plugins	www.plugins.trac.wordpress.org/browser/metasync/tags/2.6.17/admin/class-metasync-admin.php
plugins	www.plugins.trac.wordpress.org/browser/metasync/tags/2.6.17/admin/class-metasync-admin.php
plugins	www.plugins.trac.wordpress.org/changeset/3676919
plugins	www.plugins.trac.wordpress.org/browser/metasync/tags/2.6.17/admin/class-metasync-admin.php
plugins	www.plugins.trac.wordpress.org/browser/metasync/tags/2.6.16/admin/class-metasync-admin.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/1bfba54f-961d-4889-9272-0020c9fa0801

19 Sep 2026 08:16Current

CVSS 3.14.3

CWE-862