CVE-2025-12367

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level access and above, to enable or disable arbitrary SiteSEO features that they should not have access to.

• CWE-285

• https://plugins.trac.wordpress.org/browser/siteseo/tags/1.3.1/main/ajax.php#L340
• https://plugins.trac.wordpress.org/changeset/3387094/siteseo/trunk/main/ajax.php?contextall=1
• https://www.wordfence.com/threat-intel/vulnerabilities/id/54535bef-23c3-4045-bb37-ba28ae5461b1?source=cve

Published

Nov 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12361The myCred – Points Management System For Gamification, Rank…4.3
• CVE-2025-12362The myCred – Points Management System For Gamification, Rank…5.3
• CVE-2025-12363Email Password Disclosure.This issue affects BLU-IC2: throug…7.5
• CVE-2025-12364Weak Password Policy.This issue affects BLU-IC2: through 1.1…9.8
• CVE-2025-12365Error Messages Wrapped In HTTP Header.This issue affects BLU…5.3
• CVE-2025-12366The Page Builder: Pagelayer – Drag and Drop website builder …4.3
• CVE-2025-12368The Sermon Manager plugin for WordPress is vulnerable to Sto…6.4
• CVE-2025-12369The Extensions for Leaflet Map plugin for WordPress is vulne…6.4
• CVE-2025-12370The Takeads plugin for WordPress is vulnerable to authorizat…4.3
• CVE-2025-12371The Nari Accountant plugin for WordPress is vulnerable to St…4.4
• CVE-2025-12372The Permalinks Cascade plugin for WordPress is vulnerable to…4.3
• CVE-2025-12373The Torod – The smart shipping and delivery portal for e-sho…4.3