CVE-2025-13085

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13085", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-12T19:32:01.839Z", "datePublished": "2025-11-19T06:45:25.339Z", "dateUpdated": "2026-04-08T16:51:29.627Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:29.627Z"}, "affected": [{"vendor": "softaculous", "product": "SiteSEO \u2013 SEO Simplified", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SiteSEO \u2013 SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods."}], "title": "SiteSEO \u2013 SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d740ba8-4877-4b27-a1cb-26095f851ea6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/ajax.php#L542"}, {"url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/titlesmetas.php#L494"}, {"url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/admin.php#L106"}, {"url": "https://plugins.trac.wordpress.org/changeset/3397272/siteseo/trunk?contextall=1&old=3387094&old_path=%2Fsiteseo%2Ftrunk"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-285 Improper Authorization", "cweId": "CWE-285", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-12T19:49:38.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-18T18:07:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T18:57:45.363114Z", "id": "CVE-2025-13085", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T18:58:55.375Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13085", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T18:57:45.363114Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T18:58:50.844Z"}}], "cna": {"title": "SiteSEO \u2013 SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "softaculous", "product": "SiteSEO \u2013 SEO Simplified", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-12T19:49:38.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-18T18:07:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d740ba8-4877-4b27-a1cb-26095f851ea6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/ajax.php#L542"}, {"url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/titlesmetas.php#L494"}, {"url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/admin.php#L106"}, {"url": "https://plugins.trac.wordpress.org/changeset/3397272/siteseo/trunk?contextall=1&old=3387094&old_path=%2Fsiteseo%2Ftrunk"}], "descriptions": [{"lang": "en", "value": "The SiteSEO \u2013 SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:29.627Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13085", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:29.627Z", "dateReserved": "2025-11-12T19:32:01.839Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-19T06:45:25.339Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SiteSEO \u2013 SEO Simplified", "vendor": "softaculous", "versions": [{"lessThanOrEqual": "1.3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SiteSEO \u2013 SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods."}, {"lang": "es", "value": "El plugin SiteSEO - SEO Simplified para WordPress es vulnerable a una autorizaci\u00f3n incorrecta que conduce a la divulgaci\u00f3n de metadatos sensibles de publicaciones en versiones hasta e incluyendo la 1.3.2. Esto se debe a la falta de comprobaciones de autorizaci\u00f3n a nivel de objeto en el manejador AJAX resolve_variables(). Esto hace posible que atacantes autenticados con la capacidad siteseo_manage (por ejemplo, usuarios con nivel de Autor a quienes un administrador ha concedido acceso a SiteSEO) lean metadatos arbitrarios de cualquier publicaci\u00f3n, p\u00e1gina, adjunto o pedido de WooCommerce que no puedan editar, a trav\u00e9s de la funci\u00f3n de resoluci\u00f3n de variables de campo personalizado, siempre que un administrador les haya concedido acceso a SiteSEO y el almacenamiento heredado est\u00e9 habilitado. En instalaciones de WooCommerce afectadas, esto expone informaci\u00f3n sensible de facturaci\u00f3n del cliente, incluyendo nombres, direcciones de correo electr\u00f3nico, n\u00fameros de tel\u00e9fono, direcciones f\u00edsicas y m\u00e9todos de pago."}], "id": "CVE-2025-13085", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13085", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T18:57:45.363114Z", "version": "2.0.3"}}]}, "published": "2025-11-19T07:15:50.057", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/admin.php#L106"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/ajax.php#L542"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/titlesmetas.php#L494"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3397272/siteseo/trunk?contextall=1&old=3387094&old_path=%2Fsiteseo%2Ftrunk"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d740ba8-4877-4b27-a1cb-26095f851ea6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:31:21.368824+00:00", "value": {"mitigation_remediation": ["Upgrade to SiteSEO \u2013 SEO Simplified 1.3.3 or later, which removes the vulnerable AJAX handler.", "Restrict or remove the siteseo_manage capability from users who do not need it, especially Authors and Contributors.", "Disable legacy storage or the custom field variable resolution feature in the plugin settings to prevent the meta resolution pathway from being used."], "summary": {"action": "Patch", "impact": "Sensitive post metadata disclosure"}, "threat_synthesis": {"affected_systems": "WordPress websites running the SiteSEO \u2013 SEO Simplified plugin version 1.3.2 or earlier are affected. The flaw is exploitable on any content type\u2014posts, pages, attachments\u2014and on sites that have WooCommerce installed, where customer billing information is stored in post meta. Users with Author\u2011level access who have been granted SiteSEO rights by an administrator can trigger the disclosure.", "description_and_impact": "The SiteSEO \u2013 SEO Simplified plugin in WordPress versions up to 1.3.2 contains an authorization flaw in the resolve_variables() AJAX handler, allowing authenticated users with the siteseo_manage capability to read any post metadata. This can expose private fields such as customer addresses, emails, phone numbers and payment details stored in WooCommerce orders. The vulnerability is a direct consequence of missing object\u2011level permission checks, making it a classic data disclosure issue.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with the siteseo_manage role; unauthenticated users cannot exploit it. Because the data exposed are sensitive, the confidentiality impact is significant if the attacker can access billing information."}}}}, "created": "2025-11-20T10:30:41.186180+00:00", "updated": "2026-04-22T00:45:04.146161+00:00", "vendors": ["softaculous", "softaculous$PRODUCT$siteseo", "wordpress", "wordpress$PRODUCT$wordpress"]}