The SEO Metrics plugin for WordPress suffers from missing authorization checks in two critical code paths: the AJAX handler seo_metrics_handle_connect_button_click() and the seo_metrics_handle_custom_endpoint() function. In all versions up to and including 1.0.15, a subscriber‑level user can request a nonce‑protected AJAX action, capture the returned token, and then call the custom endpoint, which blindly issues the full administrator‑mode cookie set. The result is that an authenticated user with the lowest privilege can acquire administrative credentials and gain unrestricted control over the site, representing a severe authority escalation flaw. The weakness is identified as a missing authorization check (CWE‑862).

The vulnerability affects the WordPress plugin "SEO Metrics" in all releases numbered 1.0.15 or lower. Users installing these versions on any WordPress installation are at risk. No other products or vendor releases are listed as impacted.

The CVSS score of 8.8 classifies this flaw as Critical, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no confirmed public exploits yet. The flaw requires only a valid subscriber account, which is a common role on WordPress sites, widening the attack surface. An attacker with a subscriber account can exploit the AJAX handler to obtain a token and call the custom endpoint to receive administrator cookies. This demonstrates a local privilege escalation without the need for additional external attacks.