Missing authorization in the Space Codes AI for SEO plugin allows an attacker to bypass intended access controls and manipulate the plugin without proper authentication. This flaw can enable unauthorized modification of SEO settings, leading to potential data leakage or disruption of site optimization. The weakness is a classic authorization bypass, identified as CWE‑862.

All WordPress sites running Space Codes AI for SEO plugin version 1.2.9 or earlier are affected. The vulnerability applies broadly from the earliest available release up to and including 1.2.9. Administrators should verify the plugin version and upgrade if possible.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% implies a very low probability of real‑world exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Likely attack conditions involve a web request to the plugin’s administrative endpoints by a user with any role, possibly requiring authenticated access but with misconfigured permissions. Because the plugin is widely distributed, the risk is present for all installations that have not upgraded.