CVE-2025-14386 HIGH

CVE-2025-14386: Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.12 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeover

Vendor Shahrukhlinkgraph
Product Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization
Weakness CWE-862 · Missing authorization
Published January 28, 2026
Last update January 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the 'generate_sso_url' and 'validate_sso_token' functions in versions 2.4.4 to 2.5.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the 'nonce_token' authentication value to log in to the first Administrator's account.

Explanation of Vulnerability in Simple Terms

02Summary

Search Atlas SEO versions 2.4.4 through 2.5.12 lack proper authorization checks, allowing authenticated users with low privileges to read sensitive data, modify site content, or disrupt service. An attacker needs a valid WordPress account but no special role. Site owners should update immediately to prevent unauthorized access to plugin functionality.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, or disrupt the site using a low-privilege WordPress account.

Potential impact on your site

04Site Impact

Any WordPress user can exploit this to access restricted plugin features, potentially compromising SEO settings and site data.

Conditions required to exploit

05Prerequisites

Attacker must have a valid WordPress user account with low privileges; no user interaction required.

Key dates

06Disclosure timeline

January 28, 2026 CVE published
January 28, 2026 Record updated