Introduction
A subscriber-level user gaining full administrator access on a WordPress site can lead to total site compromise, data theft, and persistent backdoors. The SEO Metrics plugin, widely used for search engine optimization insights, has exposed thousands of sites to this risk through a privilege escalation vulnerability tracked as CVE-2025-6754.
About SEO Metrics Plugin: SEO Metrics is a WordPress plugin available through the official WordPress.org repository. It provides site owners with SEO metrics and analytics. The plugin is used by a broad range of WordPress sites seeking to improve their search engine rankings.
Technical Information
CVE-2025-6754 is a privilege escalation vulnerability in the SEO Metrics plugin for WordPress, specifically affecting versions 1.0.5 through 1.0.15. The root cause is the absence of authorization checks in two critical functions:
seo_metrics_handle_connect_button_click()(AJAX handler)seo_metrics_handle_custom_endpoint()
Both functions are intended to handle sensitive operations related to plugin configuration and data retrieval. However, they only check for a valid WordPress nonce to authorize the request. They do not verify the capability of the user making the request (for example, by calling current_user_can('manage_options')).
This means that any authenticated user, including those with the lowest subscriber role, can obtain a valid nonce (as nonces are generated for logged-in users) and send crafted requests to these endpoints. The vulnerable code does not include any capability checks, so the plugin processes the request regardless of the user's actual privileges.
By exploiting this flaw, a subscriber-level user can:
- Retrieve sensitive authentication tokens
- Access the custom endpoint and obtain administrator cookies
- Escalate their privileges to administrator
This is confirmed by public code references, such as:
No code snippets are included here as none are provided in public sources, but the absence of capability checks is documented in the above references.
Affected Systems and Versions
- Product: SEO Metrics plugin for WordPress
- Affected versions: 1.0.5 through 1.0.15
- Any WordPress installation with this plugin in the above version range is vulnerable
- The vulnerability is present regardless of specific WordPress configuration as long as the plugin is active
Vendor Security History
No specific information about prior vulnerabilities or the vendor's patch response time is available from public sources. The persistence of this issue across multiple versions suggests a need for improved secure coding practices.