CVE-2023-0876

Deeper analysis

The WP Meta SEO WordPress plugin before version 4.5.3 is affected by an authorization flaw in which several AJAX actions lack proper access controls. This permits low-privilege users to modify selected data and results in an arbitrary redirect vulnerability. The issue carries a CVSS 3.1 score of 6.1 with a network attack vector, low complexity, no required privileges, and required user interaction.

Low-privilege users can exploit the missing authorization over the network to perform unauthorized data updates that trigger arbitrary redirects, potentially leading to phishing or further site manipulation. The CVSS vector indicates the attack can affect the confidentiality and integrity of a reflected scope without authentication in some cases.

Public references from WPScan document the vulnerability and identify the fixed release as version 4.5.3 or later, providing the primary mitigation path of updating the plugin.

EPSS for the CVE rose materially from a low baseline to a peak of 0.1661 on 2026-03-07 before receding to the current value of 0.0230, indicating that exploitation interest emerged after disclosure.