Home

Description

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level access and above, to enable or disable arbitrary SiteSEO features that they should not have access to.

PUBLISHED Reserved 2025-10-27 | Published 2025-11-01 | Updated 2025-11-03 | Assigner Wordfence




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-285 Improper Authorization

Product status

Default status
unaffected

* (semver)
affected

Timeline

2025-10-31:Disclosed

Credits

Athiwat Tiprasaharn finder

References

www.wordfence.com/...-23c3-4045-bb37-ba28ae5461b1?source=cve

plugins.trac.wordpress.org/...teseo/tags/1.3.1/main/ajax.php

plugins.trac.wordpress.org/...unk/main/ajax.php?contextall=1

cve.org (CVE-2025-12367)

nvd.nist.gov (CVE-2025-12367)

Download JSON