CVE-2025-13085

The SiteSEO plugin for WordPress contains a flaw in its authorization checks that allows certain users with administrative privileges to access post metadata from any item they cannot edit, using the custom field resolution feature. This vulnerability affects versions up to 1.3.2, where authenticated attackers can exploit it to read sensitive information such as customer billing details and other personal data stored in WooCommerce orders.

Based on public CVE data (MITRE/NVD).