CVE-2025-49401CWE-266

WordPress smart SEO Plugin <= 4.0 - Privilege Escalation Vulnerability

Critical · published September 5, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

🔥 A privilege escalation flaw in Axiomthemes Smart SEO can turn a harmless user into an admin with a simple trick! ⚡ Think of it like a restaurant where the staff forgot to check IDs — a diner could suddenly waltz into the kitchen and start cooking without any qualifications! This vulnerability allows attackers to gain access to sensitive admin controls, potentially leading to unauthorized changes, data leaks, or even a complete takeover of your site. The consequences could be absolutely devastating for your SEO efforts and overall site security!

Put simply

Think of it like a restaurant where the staff forgot to check IDs — a diner could suddenly waltz into the kitchen and start cooking without any qualifications! The flaw stems from incorrect privilege assignments, allowing users with limited rights to perform actions reserved for administrators. This can result in unauthorized access and commands being executed at higher privilege levels without proper authorization checks.

What to do

This vulnerability allows attackers to gain access to sensitive admin controls, potentially leading to unauthorized changes, data leaks, or even a complete takeover of your site. The consequences could be absolutely devastating for your SEO efforts and overall site security! Immediately update Smart SEO to version 4.1 or later to mitigate this risk. It's also wise to review user roles and permissions to ensure everything's locked down. Don't wait — act now to safeguard your site! You've got this! With these steps, your site will be back on the path to security in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-09-05T16:15Z
EPSS history
Timeline
  • 05 SEP 16:15Z
    WordPress smart SEO Plugin <= 4.0 - Privilege Escalation Vulnerability
    cvelistv5