What the vulnerability does
01Description
The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in all versions up to, and including, 1.0.15. Because the AJAX action only verifies a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the custom endpoint to obtain full administrator cookies.
Explanation of Vulnerability in Simple Terms
02Summary
SEO Metrics versions 1.0.15 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete sensitive data and functionality. An attacker with a basic user account can perform actions restricted to administrators. Update to a version newer than 1.0.15 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data and settings that should be restricted to administrators.
Potential impact on your site
04Site Impact
Any registered user can access and alter critical SEO Metrics settings and data, compromising site configuration and data integrity.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no additional user interaction required.
Key dates
06Disclosure timeline
August 2, 2025
CVE published
April 8, 2026
Record updated
