CVE-2026-25437: 
WordPress vulnerability analysis and mitigation

CVE-2026-25437 is a Missing Authorization vulnerability in the GZSEO WordPress plugin developed by سید محمدامین هاشمی. The flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, affecting GZSEO versions from n/a through 2.0.14. It was published on March 25, 2026, with the CVE assigned by Patchstack. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations. The attack vector is network-based, requires no privileges and no user interaction, making it exploitable remotely by unauthenticated users. The specific access-controlled functionality that is improperly exposed has not been fully detailed in public disclosures, but the vulnerability class indicates that restricted plugin actions or settings can be triggered without authentication (Feedly, Patchstack).

Successful exploitation can result in limited integrity and availability impacts on the affected WordPress site, as reflected in the CVSS scoring (integrity impact: Low, availability impact: Low, confidentiality impact: None). An unauthenticated attacker could manipulate plugin settings or trigger restricted actions, potentially disrupting SEO configurations or site behavior. While the impact is not critical, unauthorized modification of SEO-related settings could affect site visibility or introduce unwanted content changes (Feedly).

The vulnerability has a very low EPSS score of approximately 0.017%, indicating a low probability of active exploitation in the near term. No public proof-of-concept exploit code, exploit kit integration, or in-the-wild exploitation has been reported as of the available data. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The lack of authentication requirement lowers the barrier for exploitation, but the limited impact scope reduces attacker incentive (Feedly).

Users of the GZSEO WordPress plugin should update to a version beyond 2.0.14, which is the last known vulnerable release. As the vulnerability was reported by Patchstack and assigned via their coordinated disclosure process, site administrators should monitor the WordPress plugin repository or the Patchstack advisory for a patched release. In the interim, disabling the GZSEO plugin on publicly accessible WordPress installations is a recommended workaround to eliminate exposure (Patchstack).