CVE-2025-13085 describes an improper authorization vulnerability (CWE-285) in the SiteSEO – SEO Simplified plugin for WordPress, affecting versions up to 1.3.2. The flaw is due to missing object-level authorization checks in the resolve_variables() AJAX handler, allowing authenticated users with the siteseo_manage capability to access arbitrary post metadata, including sensitive WooCommerce customer billing information if legacy storage is enabled. This unauthorized data disclosure impacts confidentiality but does not affect integrity or availability. The vulnerability requires the attacker to have specific plugin access granted by an administrator. No known exploits are reported, and no patch or vendor advisory is currently available.

The vulnerability allows unauthorized disclosure of sensitive post metadata, including customer billing information in WooCommerce environments. This can lead to exposure of personally identifiable information (PII) such as names, emails, phone numbers, physical addresses, and payment methods. The impact is limited to confidentiality with no direct impact on integrity or availability. The attack requires authenticated access with the siteseo_manage capability, limiting the attacker scope to users already granted some level of plugin access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully review and restrict which users are granted the siteseo_manage capability and SiteSEO access. Disabling legacy storage in WooCommerce, if feasible, may reduce exposure. Monitor for vendor updates and apply patches promptly once released.