Introduction
When a subscriber-level user gains full administrator access on a WordPress site, the result can be total site compromise, data theft, and persistent backdoors. The SEO Metrics plugin, which is widely used for search engine optimization insights, has exposed thousands of sites to this risk through a privilege escalation vulnerability tracked as CVE-2025-6754.
About the SEO Metrics plugin SEO Metrics is a WordPress plugin available from the official WordPress.org repository. It gives site owners SEO metrics and analytics, and a broad range of WordPress sites use it to improve their search engine rankings.
Technical information
CVE-2025-6754 is a privilege escalation vulnerability in the SEO Metrics plugin for WordPress, affecting versions 1.0.5 through 1.0.15. The root cause is missing authorization checks in two functions:
seo_metrics_handle_connect_button_click()(AJAX handler)seo_metrics_handle_custom_endpoint()
Both functions are meant to handle sensitive operations for plugin configuration and data retrieval. The only check they perform before accepting a request is for a valid WordPress nonce. Neither one verifies the capability of the user making the request (for example, by calling current_user_can('manage_options')).
WordPress generates nonces for logged-in users, so any authenticated user, including one with the lowest subscriber role, can obtain a valid nonce and send crafted requests to these endpoints. Because the vulnerable code contains no capability checks, the plugin processes those requests regardless of the user's actual privileges.
By exploiting this flaw, a subscriber-level user can:
- Retrieve sensitive authentication tokens
- Access the custom endpoint and obtain administrator cookies
- Escalate their privileges to administrator
Public code references confirm this, including:
This post includes no code snippets because public sources provide none. The references above document the missing capability checks.
Affected systems and versions
- Product: SEO Metrics plugin for WordPress
- Affected versions: 1.0.5 through 1.0.15
- Any WordPress installation running a plugin version in this range is vulnerable
- The vulnerability is present whenever the plugin is active, whatever the specific WordPress configuration
Vendor security history
Public sources have no specific information about prior vulnerabilities or the vendor's patch response time. The fact that this issue persisted across multiple versions suggests the vendor's secure coding practices need improvement.
