Improper Authorization Vulnerability in SiteSEO Plugin for WordPress

CVE-2025-13085

What is CVE-2025-13085?

The SiteSEO – SEO Simplified plugin for WordPress is susceptible to improper authorization, which can lead to unauthorized disclosure of sensitive post metadata. The issue arises from missing object-level authorization checks in its AJAX handler, particularly the resolve_variables() function. This vulnerability allows authenticated users with the siteseo_manage capability, such as author-level users who have been granted SiteSEO access, to access arbitrary metadata from various posts, pages, attachments, or WooCommerce orders that they normally cannot edit. In the context of WooCommerce installations, this vulnerability can result in exposure of critical customer billing details, including names, email addresses, phone numbers, physical addresses, and payment methods, especially when legacy storage is enabled.

References