CVE-2025-13085: SiteSEO WordPress Information Disclosure

CVE-2025-13085 Overview

CVE-2025-13085 affects the SiteSEO – SEO Simplified plugin for WordPress in versions up to and including 1.3.2. The vulnerability is an improper authorization flaw [CWE-285] in the resolve_variables() AJAX handler. Authenticated users with the siteseo_manage capability can read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot otherwise edit. The flaw is reachable through the custom field variable resolution feature when legacy storage is enabled. On WooCommerce installations, attackers can read customer billing data including names, email addresses, phone numbers, physical addresses, and payment methods.

Critical Impact
Authenticated attackers at Author level or above with SiteSEO access can exfiltrate sensitive customer billing data and arbitrary post metadata from WooCommerce stores.

Affected Products

SiteSEO – SEO Simplified plugin for WordPress, versions ≤ 1.3.2
WordPress sites that have granted the siteseo_manage capability to lower-privileged roles
WooCommerce installations using SiteSEO with legacy storage enabled

Discovery Timeline

2025-11-19 - CVE-2025-13085 published to the National Vulnerability Database (NVD)
2026-10-18 - Record last updated in NVD

Technical Details for CVE-2025-13085

Vulnerability Analysis

The SiteSEO plugin exposes an AJAX handler named resolve_variables() used to resolve dynamic variables (including custom field values) for SEO title and meta tag previews. The handler validates the caller's siteseo_manage capability but does not perform an object-level authorization check against the specific post ID supplied in the request. As a result, any authenticated user holding siteseo_manage can request metadata for post objects they have no edit rights over.

The scope of exposure is broad because WordPress stores metadata for many object types in wp_postmeta. This includes draft and private posts, attachments, and WooCommerce order records. On WooCommerce stores, order metadata contains personally identifiable information (PII) such as billing names, email addresses, phone numbers, shipping addresses, and payment method identifiers.

Root Cause

The root cause is a missing object-level authorization check [CWE-285] in the resolve_variables() function. The handler relies solely on a capability check (siteseo_manage) and does not call WordPress functions such as current_user_can('edit_post', $post_id) before reading get_post_meta() values for the requested object. The vulnerable code paths are referenced in admin.php L106, ajax.php L542, and titlesmetas.php L494.

Attack Vector

Exploitation requires an authenticated session with the siteseo_manage capability, which an administrator typically grants to Author-level accounts to allow SEO editing. Legacy storage must also be enabled on the affected site. The attacker issues an authenticated AJAX request to the SiteSEO variable resolution endpoint, substituting arbitrary post IDs (including WooCommerce order IDs) to retrieve custom field values. The response discloses the requested post meta content, enabling bulk enumeration of PII and other sensitive stored data.

For exploitation specifics, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-13085

Indicators of Compromise

Repeated authenticated POST requests to admin-ajax.php with a SiteSEO action parameter and varying post_id values
Non-administrator accounts (Author, Editor, Contributor) issuing requests that reference WooCommerce shop_order object IDs
Spikes in admin-ajax.php request volume originating from a single authenticated user session
Access to post IDs the authenticated user does not own and has no edit capability over

Detection Strategies

Enable WordPress audit logging and alert on admin-ajax.php calls to SiteSEO endpoints initiated by non-administrator roles
Correlate the account's assigned role with the object type of the requested post_id to flag cross-boundary metadata reads
Deploy a Web Application Firewall (WAF) rule to rate-limit SiteSEO AJAX requests per authenticated session

Monitoring Recommendations

Review the WordPress user roster for every account that has been granted the siteseo_manage capability
Monitor outbound responses from admin-ajax.php for payloads containing billing email, phone, or address fields
Baseline normal SiteSEO AJAX call patterns and alert on deviations in volume or object-type diversity

How to Mitigate CVE-2025-13085

Immediate Actions Required

Update the SiteSEO – SEO Simplified plugin to a version later than 1.3.2 that contains the patch referenced in the plugin changeset
Audit all WordPress accounts and revoke the siteseo_manage capability from users who do not require SEO administration
On WooCommerce stores, review order access logs for anomalous reads by non-administrator accounts

Patch Information

The vendor addressed the missing authorization check in the plugin changeset 3397272. The fix adds object-level authorization validation before resolving custom field variables in the AJAX handler. See the WordPress Plugin Change Log for the applied diff.

Workarounds

Disable the SiteSEO legacy storage option, which is a required precondition for exploitation
Temporarily restrict the siteseo_manage capability to Administrator-level roles only until the patch is deployed
Deactivate the SiteSEO plugin on WooCommerce stores that cannot patch immediately and process customer PII

bash

# Configuration example: revoke siteseo_manage from non-admin roles using WP-CLI
wp cap remove author siteseo_manage
wp cap remove editor siteseo_manage
wp cap remove contributor siteseo_manage

# Verify the current plugin version and update
wp plugin get siteseo --field=version
wp plugin update siteseo