Cloud Vulnerability DB
A community-led vulnerabilities database
Introducing Wiz for Exposure Management: Unify, prioritize, and remediate exposures everywhere.
Vulnerability DatabaseCVE-2025-6754
CVE-2025-6754:
WordPress vulnerability analysis and mitigation
Overview
CVE-2025-6754 affects the SEO Metrics plugin for WordPress versions 1.0.5 through 1.0.15. The vulnerability was discovered and reported by Wordfence, with the initial disclosure on August 2, 2025. This security issue impacts WordPress installations with the SEO Metrics plugin installed, particularly affecting the authentication and authorization mechanisms (NVD).
Technical details
The vulnerability stems from missing authorization checks in two key functions: seometricshandleconnectbuttonclick() AJAX handler and seometricshandlecustom_endpoint() function. The security flaw exists because the AJAX action only verifies a nonce without checking the caller's capabilities. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a serious security risk (NVD).
Impact
The vulnerability allows subscriber-level users to retrieve authentication tokens and subsequently access custom endpoints to obtain full administrator cookies. This effectively enables privilege escalation from a low-privileged subscriber account to administrative access, potentially compromising the entire WordPress installation (NVD).
Mitigation and workarounds
The plugin has been temporarily closed as of July 30, 2025, pending a full security review. Users are advised to disable and remove the SEO Metrics plugin until a patched version is released (WordPress Plugin).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management