SEOPress <= 8.1.1 is vulnerable to Broken Access Control vulnerability

Subscriber

Published
2024-10-23

The SEOPress – On-site SEO plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 8.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVE

https://www.cve.org/CVERecord?id=CVE-2024-50455

CVSS

Score:4.3

Severity:Medium

Version: 8.1.1

There is a patch available in v8.2 and we strongly recommend you update to this version as soon as possible.