PT-2026-5088 · WordPress · Wordpress+1

Kenneth Dunn · Publicado 2026-01-28 · Atualizado 2026-01-28 · CVE-2025-14386

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization versions 2.4.4 through 2.5.12

Description The Search Atlas SEO plugin for WordPress has a flaw that allows authentication bypass. This occurs because of a missing capability check within the generate sso url and validate sso token functions. Attackers with Subscriber-level access or higher can extract the nonce token authentication value and use it to log in as the first Administrator account.

Recommendations Versions 2.4.4 through 2.5.12 should be updated to a fixed version, if available. As a temporary workaround, restrict access to the generate sso url and validate sso token functions.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14386

Produtos afetados

Search Atlas Seo

Wordpress

Referências · 8

• https://t.me/cveNotify/150109 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L1141 · Nota
• https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L851 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/6f63d2c4-cbae-4177-8494-daca96449ecc?source=cve · Nota
• https://twitter.com/CVEnew/status/2016478175736332567 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14386 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L1042 · Nota
• https://twitter.com/CveFindCom/status/2016529549807259945 · Publicação no Twitter