SiteSEO SEO Simplified Missing Authorization Vulnerability in WordPress Plugin

A missing authorization vulnerability has been identified in the SiteSEO – SEO Simplified plugin for WordPress, affecting versions through 1.3.1. The vulnerability arises because the plugin fails to properly verify user authorization for certain actions. This flaw allows authenticated attackers with Author-level access or higher to enable or disable SiteSEO features that should be restricted.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in SiteSEO plugin settings, allowing attackers to manipulate SEO features without proper authorization.

Remediation

Users are advised to update the SiteSEO – SEO Simplified plugin to version 1.3.2 or a newer patched version.