SiteSEO – SEO Simplified Vulnerability – Missing Authorization to Authenticated (Author+) Plugin Settings Update – CVE-2025-12367 | WordPress Plugin Vulnerability Report

Plugin Name: SiteSEO – SEO Simplified

Key Information:

Software Type: Plugin
Software Slug: siteseo
Software Status: Active
Software Author: softaculous
Software Downloads: 976,564
Active Installs: 400,000
Last Updated: November 1, 2025
Patched Versions: 1.3.2
Affected Versions: ≤ 1.3.1

Vulnerability Details:

Name: SiteSEO – SEO Simplified ≤ 1.3.1 – Missing Authorization to Authenticated (Author+) Plugin Settings Update
Type: Missing Authorization
CVE: CVE-2025-12367
CVSS Score: 4.3 (Medium)
Publicly Published: October 31, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
Description:
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1. This occurs because the plugin fails to properly verify that a user is authorized to modify plugin settings. Authenticated attackers with Author-level access or higher can enable or disable SiteSEO features they should not be able to control. This flaw could be used to disrupt SEO functionality or alter how search engines index a site.

Summary:

The SiteSEO – SEO Simplified plugin for WordPress has a vulnerability in versions up to and including 1.3.1 that allows authenticated users with Author-level access and above to modify plugin settings without proper authorization. This could result in unauthorized SEO changes that affect how a website is indexed by search engines. The issue has been patched in version 1.3.2.

Detailed Overview:

This vulnerability, discovered by Athiwat Tiprasaharn (Jitlada), stems from insufficient authorization checks within the plugin’s administrative settings functions. In affected versions, SiteSEO does not confirm whether the user attempting to modify settings has the required administrative privileges.

This oversight allows logged-in users with Author-level permissions to toggle SEO features or change key configurations that influence indexing, metadata, or sitemaps. While the vulnerability does not allow full site compromise or data theft, it presents a risk to website visibility and search performance.

The vulnerability has a CVSS score of 4.3, indicating medium severity. It was publicly disclosed on October 31, 2025. The developer, Softaculous, released version 1.3.2 on November 1, 2025, resolving the issue by implementing proper authorization validation to restrict sensitive settings to administrator roles.

Advice for Users:

Immediate Action:
Update the SiteSEO – SEO Simplified plugin to version 1.3.2 or later immediately. The update corrects the missing authorization checks and prevents unauthorized SEO modifications.

Check for Signs of Vulnerability:
Review your SEO configurations within the plugin. Ensure no unexpected changes were made to indexing options, meta settings, or sitemaps. Check plugin logs, if available, to confirm that only administrators have recently modified settings.

Alternate Plugins:
Although a patch is available, users who want to explore alternatives may consider Yoast SEO, Rank Math, or All in One SEO Pack, all of which provide comprehensive optimization tools and have strong security track records.

Stay Updated:
Keep all WordPress plugins up to date. Regularly updating your software ensures you are protected against known vulnerabilities. Consider enabling automatic updates or subscribing to vulnerability alerts.

Conclusion:

The quick release of a patch by Softaculous demonstrates a responsible approach to plugin security. Users should confirm they are running version 1.3.2 or later to eliminate the risk.

Regular maintenance and prompt updates are essential for keeping WordPress installations secure. Small business owners, in particular, should consider automated update services or professional maintenance support to ensure vulnerabilities are patched before attackers can exploit them.

Detailed Report

A moderate but important vulnerability has been discovered affecting hundreds of thousands of WordPress websites using the popular SiteSEO – SEO Simplified plugin. Versions up to and including 1.3.1 are affected by a missing authorization flaw that allows authenticated users with Author-level access or higher to change plugin settings without proper permissions. In this post, we’ll explain the vulnerability and what you need to do to secure your site.

The SiteSEO plugin, developed by Softaculous, is a widely used SEO optimization tool that helps WordPress users improve their website ranking and visibility. However, a recent security issue identified by researcher Athiwat Tiprasaharn (Jitlada) revealed that the plugin fails to verify user permissions in affected versions. This allows logged-in users with limited roles to enable or disable critical SEO features that affect how search engines crawl and index your website.

Although the vulnerability is classified as medium severity, it can still lead to harmful consequences for businesses. An attacker or unauthorized user could intentionally or accidentally disable important features, resulting in a loss of organic search traffic or reduced search visibility.

If you notice unexpected changes to your SEO configuration or if your website suddenly drops in search rankings, it could be a sign that your settings were modified by an unauthorized user. To fix the problem, update to version 1.3.2 immediately. The patched version includes proper authorization controls to prevent lower-privilege users from changing restricted settings.

For website owners who rely on SEO to drive traffic, this type of vulnerability can have lasting impacts on search performance. Staying proactive with updates ensures your website remains optimized and protected. If you don’t have time to manage plugin updates yourself, consider using a WordPress maintenance or security service to automate updates and monitor vulnerabilities.

By keeping your plugins current, you can safeguard your website against emerging threats and maintain consistent visibility in search engines.

Staying Secure

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.