CVE-2025-12814CWE-285

CVE-2025-12814

Medium · published November 19, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, who have been granted access to at least on SiteSEO setting capability, to reset the plugin's settings.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-285 · Improper Authorization
Published
2025-11-19T11:15Z
References (3)
https://plugins.trac.wordpress.org/browser/siteseo/tags/1.3.2/main/ajax.php#L90 · [email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397272%40siteseo&new=3397272%40siteseo&sfp_email=&sfph_mail= · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/a376cafb-656c-4fe1-b5c1-c7e38dc5040e?source=cve · [email protected]
EPSS history
Timeline
  • 19 NOV 05:45Z
    SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset
    cvelistv5