CVE-2024-50455: SEOPress Authorization Bypass Vulnerability

CVE-2024-50455 Overview

CVE-2024-50455 is a missing authorization vulnerability in the SEOPress WordPress plugin developed by Benjamin Denis. The flaw affects all versions of wp-seopress up to and including 8.1.1. The plugin exposes functionality protected by incorrectly configured access control checks, allowing authenticated users with low privileges to invoke restricted actions. Exploitation impacts confidentiality, integrity, and availability of the WordPress site running the plugin. The vulnerability maps to CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with minimal privileges can bypass access control checks in SEOPress to perform actions restricted to higher-privileged roles, compromising WordPress site data and configuration.

Affected Products

SEOPress WordPress plugin versions up to and including 8.1.1
Sites running wp-seopress on any WordPress deployment
All SEOPress installations prior to the vendor-supplied patched release

Discovery Timeline

2024-10-29 - CVE-2024-50455 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50455

Vulnerability Analysis

SEOPress exposes plugin actions without enforcing sufficient capability or nonce checks. An authenticated user with a low-privileged role can send crafted requests to plugin endpoints and trigger operations reserved for administrators. Because SEOPress manages SEO metadata, redirects, sitemaps, and content-related configuration, an unauthorized action can alter site behavior, expose sensitive data, or disrupt availability.

The issue falls under the broken access control category. Vulnerable code paths do not verify whether the calling user holds the correct WordPress capability such as manage_options before executing privileged plugin logic. This mismatch between intended and enforced access control levels is the defining trait of CWE-862.

Root Cause

The root cause is missing or improperly configured authorization checks on SEOPress action handlers. The plugin registers endpoints reachable by authenticated users but does not consistently validate role, capability, or intent through nonces. Attackers who already hold a subscriber-level or contributor-level account can therefore reach functionality that should require higher privileges.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privileged authenticated session. The attacker sends HTTP requests to SEOPress endpoints, bypassing role-based restrictions to invoke privileged operations. No user interaction is needed beyond the attacker's own request. Refer to the Patchstack Vulnerability Report for technical details on the specific affected handlers.

Detection Methods for CVE-2024-50455

Indicators of Compromise

Unexpected changes to SEOPress plugin settings, redirects, sitemap configuration, or SEO metadata across posts and pages
HTTP POST requests to admin-ajax.php or wp-admin/admin-post.php with SEOPress-related action parameters originating from non-administrator accounts
New or modified WordPress users, options, or redirects that correlate with SEOPress request activity
Access log entries showing subscriber or contributor accounts calling SEOPress endpoints

Detection Strategies

Audit WordPress access logs for requests to SEOPress action handlers issued by users below the administrator role
Compare current plugin option values against a known-good baseline to identify unauthorized configuration changes
Monitor the WordPress options table for unexpected writes to keys prefixed with seopress_
Correlate authentication events for low-privileged accounts with subsequent plugin action requests

Monitoring Recommendations

Enable WordPress audit logging that captures user role, action, and target for every plugin request
Forward web server and PHP-FPM logs to a centralized platform for retention and query
Alert on any privileged plugin operation invoked by a non-administrator session
Track the installed version of wp-seopress across managed WordPress sites to confirm patch status

How to Mitigate CVE-2024-50455

Immediate Actions Required

Update SEOPress to a version later than 8.1.1 that contains the vendor's authorization fix
Review all WordPress user accounts and remove or downgrade unused low-privileged accounts that could serve as an entry point
Rotate credentials for accounts that show suspicious SEOPress-related activity in access logs
Restore SEOPress settings and site content from a known-good backup if unauthorized changes are detected

Patch Information

The vendor addresses the issue in a release after SEOPress 8.1.1. Administrators should apply the latest available update from the WordPress plugin repository. Consult the Patchstack Vulnerability Report for the fixed version reference.

Workarounds

Restrict authenticated access to WordPress by disabling open user registration until the plugin is updated
Deploy a web application firewall rule to block requests to SEOPress action endpoints from non-administrator sessions
Temporarily deactivate the SEOPress plugin if patching cannot be performed immediately
Enforce strong authentication and multi-factor authentication for all WordPress accounts to reduce the pool of usable low-privileged sessions

bash

# Configuration example: disable open registration and deactivate plugin via WP-CLI
wp option update users_can_register 0
wp plugin deactivate wp-seopress
wp plugin update wp-seopress