PT-2026-5088 · WordPress · Wordpress+1

Kenneth Dunn · Published 2026-01-28 · Updated 2026-01-28 · CVE-2025-14386

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization versions 2.4.4 through 2.5.12

Description The Search Atlas SEO plugin for WordPress has a flaw that allows authentication bypass. This occurs because of a missing capability check within the generate sso url and validate sso token functions. Attackers with Subscriber-level access or higher can extract the nonce token authentication value and use it to log in as the first Administrator account.

Recommendations Versions 2.4.4 through 2.5.12 should be updated to a fixed version, if available. As a temporary workaround, restrict access to the generate sso url and validate sso token functions.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14386

Affected Products

Search Atlas Seo

Wordpress

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14386 · Security Note
• https://t.me/cveNotify/150109 · Telegram Post
• https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L1141 · Note
• https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L851 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6f63d2c4-cbae-4177-8494-daca96449ecc?source=cve · Note
• https://twitter.com/CVEnew/status/2016478175736332567 · Twitter Post
• https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L1042 · Note
• https://twitter.com/CveFindCom/status/2016529549807259945 · Twitter Post