An incorrect privilege assignment flaw in the Xagio SEO WordPress plugin allows an attacker to elevate their access level. The vulnerability could enable a non‑administrator to gain administrative rights, giving control over the site’s settings, content, and users. This compromise directly threatens confidentiality, integrity, and availability of the WordPress installation.

The flaw affects the Xagio SEO plugin for WordPress. All released versions up to and including 7.1.0.30 are impacted. No specific WordPress core version is mentioned in the advisory, so the vulnerability is assumed to be independent of the core version.

The CVSS score of 9.8 indicates a severe risk. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly described in the advisory; it is inferred that exploitation may occur through the plugin’s web interface or configuration pages, requiring the attacker to be able to interact with the plugin’s settings or content management functions.