The Xagio SEO WordPress plugin contains a missing authorization flaw (CWE-862) that allows attackers to bypass the intended access control settings, enabling them to modify plugin settings or retrieve sensitive data and thereby compromising the confidentiality, integrity, and availability of the WordPress site.

The vulnerability affects Xagio SEO’s WordPress plugin versions up to and including 7.1.0.37, with the specific 7.1.0.29 release noted as vulnerable. Any WordPress installation that has a vulnerable version of the Xagio SEO plugin is at risk.

The CVSS score of 4.3 places the vulnerability in the moderate severity range, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack path involves a web‑based request to the plugin’s admin endpoints, exploiting the missing authorization check; the attacker does not need prior authentication beyond a normal WordPress user role that has plugin management rights. Since the flaw is a broken access control, any attempt to elevate privileges within the plugin’s scope can be executed by a user who normally lacks those permissions.