Technical impact
The SiteSEO – SEO Simplified plugin in WordPress versions up to 1.3.2 contains an authorization flaw in the resolve_variables() AJAX handler, allowing authenticated users with the siteseo_manage capability to read any post metadata. This can expose private fields such as customer addresses, emails, phone numbers and payment details stored in WooCommerce orders. The vulnerability is a direct consequence of missing object‑level permission checks, making it a classic data disclosure issue.
Affected Systems
WordPress websites running the SiteSEO – SEO Simplified plugin version 1.3.2 or earlier are affected. The flaw is exploitable on any content type—posts, pages, attachments—and on sites that have WooCommerce installed, where customer billing information is stored in post meta. Users with Author‑level access who have been granted SiteSEO rights by an administrator can trigger the disclosure.
Risk and Exploitability
The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with the siteseo_manage role; unauthenticated users cannot exploit it. Because the data exposed are sensitive, the confidentiality impact is significant if the attacker can access billing information.
