CVE-2026-15947

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of...

CVE-2026-15947 Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of...

EUVD-2026-83572

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of...

CVE-2026-15947

The Metasync plugin for WordPress (also referenced as Search Atlas SEO ) is vulnerable to unauthorized data modification in versions up to and including 2.6.23 . The root cause is a missing capability check on the save_instant_indexing_settings() function registered on the admin_init hook, which ...

CVE-2026-15947: Missing Authorization

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of...

PT-2026-95782

Name of the Vulnerable Software and Affected Versions Metasync versions prior to 2.6.24 Description The Metasync plugin for WordPress allows unauthorized modification of data because the save instant indexing settings function lacks a capability check. The function is registered on the admin init...

CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

CVE-2026-84700

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g., 11221 for the default 9221) that lacks authentication for non-MetaSync messages. The root cause is that the frame dispatcher (DealMessage ) does not require a completed o...

Unspecified vulnerability in WordPress plugin metasync

WordPress is a set of blogging platform developed using the PHP language, the platform has the ability to set up a personal blog site on a server based on PHP and MySQL, WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin metasync, which stems from a...

WordPress plugin metasync 安全漏洞

WordPress is a set of blogging platform developed using the PHP language, the platform has the ability to set up a personal blog site on a server based on PHP and MySQL, WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin metasync, which stems from a...

CVE-2025-58019: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through = 2.5.4...

CVE-2024-47387: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through = 1.8.2...