The SiteSEO – SEO Simplified plugin for WordPress has a missing authorization flaw in versions up to 1.3.1. The flaw allows authenticated users with Author-level access or higher to enable or disable arbitrary SiteSEO features without proper permission checks. This results in unexpected changes to SEO configuration, which can affect site visibility, search rankings, and potentially expose sensitive content. The weakness corresponds to CWE-285, Unauthorized Access.

Softaculous’ SiteSEO – SEO Simplified plugin is affected, specifically all installed copies running version 1.3.1 or older. The vulnerability exists within the plugin’s AJAX handling code on WordPress sites that have the plugin active. Users should verify the installed plugin version and plan an upgrade if the current version is 1.3.1 or earlier.

The vulnerability has a CVSS base score of 4.3, indicating moderate severity. Its EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Because the flaw requires authentication and an Author or higher role, an attacker must be already able to log into the WordPress installation. Once authenticated, the attacker can toggle any feature controlled by the plugin, but there is no path to arbitrary code execution or full system compromise. The risk is therefore localized to the SEO configuration of the affected site.