CVE-2025-13085

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods.

• CWE-285

• https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/admin.php#L106
• https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/ajax.php#L542
• https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/titlesmetas.php#L494
• https://plugins.trac.wordpress.org/changeset/3397272/siteseo/trunk?contextall=1&old=3387094&old_path=%2Fsiteseo%2Ftrunk
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4d740ba8-4877-4b27-a1cb-26095f851ea6?source=cve

Published

Nov 19, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1308A vulnerability exists in PX Backup whereby sensitive inform…8.4
• CVE-2025-13080Improper Check for Unusual or Exceptional Conditions vulnera…5.3
• CVE-2025-13081Improperly Controlled Modification of Dynamically-Determined…5.9
• CVE-2025-13082User Interface (UI) Misrepresentation of Critical Informatio…4.3
• CVE-2025-13083Use of Web Browser Cache Containing Sensitive Information vu…3.7
• CVE-2025-13084The users endpoint in the groov View API returns a list of a…7.6
• CVE-2025-13086Improper validation of source IP addresses in OpenVPN versio…7.5
• CVE-2025-13087A vulnerability exists in the Opto22 Groov Manage REST API o…7.5
• CVE-2025-13088The Category and Product Woocommerce Tabs plugin for WordPre…8.8
• CVE-2025-13089The WP Directory Kit plugin for WordPress is vulnerable to S…7.5
• CVE-2025-1309The UiPress lite | Effortless custom dashboards, admin theme…8.8
• CVE-2025-13090The WP Directory Kit plugin for WordPress is vulnerable to S…4.9