CVE-2025-6754
Published: 02 August 2025
Summary
CVE-2025-6754 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 39.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-6754 is a privilege escalation vulnerability in the SEO Metrics plugin for WordPress, affecting all versions up to and including 1.0.15. The flaw arises from missing authorization checks in the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function, classified under CWE-862 (Missing Authorization). Published on 2025-08-02, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
The vulnerability can be exploited by a subscriber-level user with low privileges over the network, requiring low complexity and no user interaction. The attacker first triggers the AJAX handler, which only verifies a nonce without validating the caller's capabilities, to retrieve a token. Using this token, the attacker accesses the custom endpoint to obtain full administrator cookies, achieving complete privilege escalation from subscriber to administrator access.
References provided include source code files from the WordPress plugin trac repository—common-functions.php, endpoint.php, seo-metrics.php, and welcome-page.php—along with changeset 3343566 for the seo-metrics-helper plugin. Security practitioners should examine these resources to identify the vulnerable code paths and verify any remediation commits or updates in newer plugin versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23426
Vulnerability details
The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in all versions up to, and including, 1.0.15. Because the AJAX action only verifies…
more
a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the custom endpoint to obtain full administrator cookies.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in public-facing WordPress plugin directly enables remote privilege escalation from low-privileged account to administrator.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires enforcement of approved authorizations for logical access, directly addressing the missing authorization checks in the plugin's AJAX handler and custom endpoint that allow privilege escalation.
AC-6 enforces least privilege, preventing a subscriber-level user from escalating to administrator access via the vulnerable token retrieval and cookie theft mechanisms.
SI-2 mandates timely identification, reporting, and correction of system flaws, directly mitigating this specific missing authorization vulnerability by requiring plugin updates or patches.