Executive brief
The Metasync plugin for WordPress fails to verify user permissions before allowing changes to Google Instant Indexing configuration. An attacker with a basic subscriber account can modify which content types are automatically submitted to Google's indexing service, potentially disrupting search visibility or redirecting traffic.
Technical details
The save_instant_indexing_settings() function in the admin hook lacks capability checks and nonce verification, allowing authenticated subscribers and above to directly modify the 'metasync_options_instant_indexing' option via unsanitized POST data. The only guard is a check for $_POST['submit'], leaving the function exposed to cross-site request forgery and unauthorized configuration changes.
Affected products
- Metasync Metasync up to 2.6.23
Timeline
- 2026-09-19: disclosed