CVE-2025-6754: Seometricsplugin Seo Metrics

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in all versions up to, and including, 1.0.15. Because the AJAX action only verifies a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the custom endpoint to obtain full administrator cookies.

Affected products

• Seometricsplugin Seo Metrics: up to and including 1.0.15

Published 2025-08-02. Last modified 2026-06-17.