Privilege Escalation Vulnerability in SEO Metrics Plugin for WordPress

CVE-2025-6754

What is CVE-2025-6754?

The SEO Metrics plugin for WordPress contains a vulnerability that allows a subscriber-level user to escalate their privileges. This occurs due to inadequate authorization checks in key AJAX handlers, specifically the seo_metrics_handle_connect_button_click() and seo_metrics_handle_custom_endpoint() functions. By exploiting the nonce validation alone, an attacker can obtain sensitive administrator tokens, leading to unauthorized access to administrative functionalities. Users are advised to update their plugin to the latest version to mitigate this security risk.

References