CVE-2026-15947 shahrukhlinkgraph CVE debrief

Who should care

WordPress administrators and defenders should be aware of this vulnerability and take steps to verify the presence of the Metasync plugin in their installations and ensure that it is updated to a fixed version.

Why it matters

The Metasync plugin for WordPress has a vulnerability allowing unauthorized modification of data, which can be exploited by authenticated attackers with Subscriber-level access and above. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and ensure that the Metasync plugin is updated to a fixed version.

• Authenticated attackers with Subscriber-level access and above can modify the site's Google Instant Indexing post-type configuration
• The vulnerability allows for unauthorized modification of data
• Defenders need to verify the presence of this vulnerability in their WordPress installations
• Remediation priority is high for WordPress installations using the Metasync plugin

Technical summary

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and ensure that the Metasync plugin is updated to a fixed version.

Recommended defensive actions

• Verify the presence of the Metasync plugin in your WordPress installation
• Check if the plugin version is 2.6.23 or earlier
• Update the plugin to a fixed version if necessary
• Monitor for suspicious activity related to the save_instant_indexing_settings() function
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a missing capability check on the save_instant_indexing_settings() function in the Metasync plugin for WordPress. The function is registered on the admin_init hook and writes attacker-supplied data into the site-wide 'metasync_options_instant_indexing' option without proper checks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.