Missing Authorization Vulnerability in SiteSEO Plugin for WordPress
CVE-2025-12367

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Siteseo – Seo Simplified
Vendor
CVE Published:
1 November 2025

What is CVE-2025-12367?

The SiteSEO – SEO Simplified plugin for WordPress has a vulnerability related to Missing Authorization. In versions up to 1.3.1, the plugin fails to validate whether users have the proper authorization to perform critical actions. This oversight allows authenticated users with Author-level permissions and above to indiscriminately enable or disable functionalities within the SiteSEO plugin that should otherwise be restricted. Such unauthorized access poses a significant security risk and highlights the importance of proper permission checks within WordPress plugins.

Affected Version(s)

SiteSEO – SEO Simplified * <= 1.3.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/siteseo/tags/1...
https://plugins.trac.wordpress.org/changeset/3387094/site...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Athiwat Tiprasaharn
JSON
.
CVE-2025-12367 : Missing Authorization Vulnerability in SiteSEO Plugin for WordPress