CVE-2025-12814

SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset

Published Nov 19, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, who have been granted access to at least on SiteSEO setting capability, to reset the plugin's settings.

Analysis

Technical impact

The SiteSEO – SEO Simplified WordPress plugin is vulnerable because the siteseo_reset_settings function performs an incorrect capability check, allowing an authenticated user with any SiteSEO setting capability to reset the plugin’s configuration. This flaw permits attackers to wipe custom SEO settings and disrupt site visibility, although it does not lead to remote code execution or data exfiltration.

Affected Systems

The flaw affects the SiteSEO – SEO Simplified plugin (Softaculous) on all installed versions up to and including 1.3.2. It applies to any WordPress site where the plugin is active and the user has SiteSEO setting permissions.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with at least SiteSEO setting capability—a privilege escalation scenario. The vulnerability allows only configuration resets, not arbitrary code execution or data loss.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

softaculous

SiteSEO – SEO Simplified

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.3.2

No data.

Vendor	Product	Versions
Softaculous	Siteseo	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the SiteSEO – SEO Simplified plugin to version 1.3.3 or later, where the capability check is corrected.
If an immediate plugin update is not feasible, revoke or restrict the SiteSEO settings capability from users who do not require it.
Audit WordPress user roles and capabilities to ensure only trusted administrators retain SiteSEO management rights.

Generated by OpenCVE AI on April 21, 2026 at 01:29 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.280% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/siteseo/tags/1.3.2/main/ajax.php#L90
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397272%40siteseo&new=3397272%40siteseo&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/a376cafb-656c-4fe1-b5c1-c7e38dc5040e?source=cve

History

Nov 21, 2025 9:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Softaculous Softaculous siteseo Wordpress Wordpress wordpress
Vendors & Products		Softaculous Softaculous siteseo Wordpress Wordpress wordpress

Nov 19, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 19, 2025 6:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, who have been granted access to at least on SiteSEO setting capability, to reset the plugin's settings.
Title		SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset
Weaknesses		CWE-285
References		https://plugins.trac.wordpress.org/browser/siteseo/tags/1.3.2/main/ajax.php#L90 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397272%40siteseo&new=3397272%40siteseo&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/a376cafb-656c-4fe1-b5c1-c7e38dc5040e?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`