The flaw in the SEOPress PRO plugin is a broken access control that permits a user lacking administrative privileges to perform actions reserved for higher‑privilege roles. This could allow the user to alter critical SEO settings, potentially redirecting traffic or modifying site metadata in ways that compromise the site’s integrity. The impact is therefore a compromise of the site’s configuration and an increased risk of subsequent attacks that leverages the abused privileges.

Any WordPress site that has installed SEOPress PRO version 9.1.1 or earlier. The vulnerability affects installations where the plugin version satisfies the "<= 9.1.1" criterion.

The CVSS score of 4.3 places this issue in the medium severity range, indicating a moderate potential impact if exploited. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the available metrics. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the plugin’s web interface; based on the description, it is inferred that the flaw requires authentication, as the access control checks are part of the administrative workflow, but no explicit statement confirms whether unauthenticated sessions can exploit the issue.