CVE-2025-6754

CVE-2025-6754 is a high severity vulnerability affecting the affected product.

Description: The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in versions 1.0.5 through 1.0.15. Because the AJAX action only verifies a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the […]

Affected Versions:
❌ Vulnerable: 1.0.5 - 1.0.15
✅ Safe: ≥ 1.0.16

Exploit Difficulty: EASY
⏱️ Time to exploit: < 1 hour
🛠️ Required skills: Basic web security knowledge
💰 Public exploits: Likely available

How to Fix:


- Check if you're running the affected product
- Verify version (vulnerable: 1.0.5 - 1.0.15)


- Update to ≥ 1.0.16 or later
- If patching is not immediately possible: restrict network exposure, apply least-privilege access


- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)


- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations