EUVD-2026-45878
GHSA-8hj6-5c8v-39ff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor-level WordPress account
-
DeliveryLocate AI integration REST API endpoint
-
ExploitSend crafted authorized HTTP request
-
ExecutionOverwrite or reset site-wide AI integration state
-
ImpactSEO configuration disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress session with at least Contributor-level privileges - Contributor is the lowest role that can be assigned beyond Subscriber in a default WordPress installation. The target site must have the All in One SEO plugin installed and the AI integration feature configured (i.e., the AI endpoints must be present and active). Exploitation is limited to integrity of the AI integration state; no confidentiality impact is possible under this vulnerability. Sites that do not use the AI integration feature of the plugin, or where Contributor registration is disabled or tightly controlled, face negligible real-world risk. The CVSS PR:H assignment conflicts with the description's reference to Contributors as the minimum required role - defenders should treat PR:L as the realistic privilege threshold. |
| Impact | The NVD-assigned CVSS 3.1 score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) reflects limited impact, but the PR:H metric appears inconsistent with the description: Contributors are low-privilege users (PR:L in CVSS terminology), not high-privilege ones. This discrepancy suggests the official vector may understate how easily an authenticated attacker can exploit this - any registered site member with Contributor role qualifies, not just administrators. The integrity impact is real but bounded: an attacker can disrupt or manipulate AI integration settings site-wide, potentially sabotaging automated SEO workflows, but cannot read sensitive data or take the site offline. No EPSS score is available in the provided data, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. However, a publicly available POC (via WPScan) lowers the bar for abuse. The real-world priority is moderate for sites with open contributor registration or untrusted authenticated users; it is low for sites where contributor accounts are tightly controlled. |
| Exploit ScenarioDerived | An attacker registers or compromises a Contributor account on the target WordPress site and directly calls the All in One SEO AI integration REST API endpoint with a crafted HTTP request to reset or overwrite the plugin's site-wide AI configuration. A publicly available proof-of-concept facilitates this, requiring only a valid authentication token for a low-privilege account. The result is disruption or manipulation of the site's AI-driven SEO settings without any administrator awareness. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 20, 2026
Incorrect authorization on REST API endpoints in the All in One SEO WordPress plugin (before 4.9.9) allows authenticated users with low-level roles such as Contributor to overwrite or reset the site-wide AI integration configuration. The flaw is classified under CWE-863 (Incorrect Authorization), meaning the plugin registers REST API routes without enforcing appropriate role checks before permitting state-modifying operations. A publicly available proof-of-concept exists per WPScan, though no active exploitation has been confirmed by CISA KEV. The practical blast radius is limited to integrity of the plugin's AI settings, with no evidence of confidentiality or availability impact.
RemediationAI
Update the All in One SEO plugin to version 4.9.9 or later, as confirmed by the WPScan advisory (https://wpscan.com/vulnerability/cc4e83e3-b581-4f65-ac2c-24fbfb9da4b3/) and EUVD-2026-45878. Patched releases are available through the official WordPress plugin repository. If immediate patching is not feasible, sites should audit and restrict Contributor-level accounts, removing any untrusted or unnecessary contributor registrations. As an additional compensating control, REST API access can be restricted via a Web Application Firewall or server-level rules to block unauthenticated and low-privilege access to the plugin's AI integration endpoints; however, this may break legitimate plugin functionality and should be tested in a staging environment before production deployment. Site administrators should also review the current AI integration state for unexpected modifications to confirm no unauthorized changes were made prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
All in One SEO is a widely deployed WordPress plugin that exposes REST API endpoints for managing AI-assisted SEO features. The root cause is CWE-863 (Incorrect Authorization): the plugin registers one or more REST API routes that perform privileged write operations (overwrite or reset AI integration state) but fails to enforce that only high-privilege roles (e.g., Administrator or Editor) may call them. Because WordPress's permission model distinguishes roles from Subscriber through Administrator, Contributors - who can draft posts but hold no administrative capabilities - should not have write access to site-wide plugin configuration. The CPE string (cpe:2.3:a:unknown:all_in_one_seo:*:*:*:*:*:*:*:*) confirms the affected product, though the vendor field is listed as 'unknown' in NVD, which is a minor data-quality gap. The vulnerability is network-reachable via the WordPress REST API, which is typically accessible without IP restriction on public-facing installations.
Know when All In One Seo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Contributors are low-privilege users (PR:L), not high-privilege; AV:N reflects REST API access; no confidentiality or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in All In One Seo
View allThe All in One SEO - Best WordPress SEO Plugin - Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated u
Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the cont
Unauthenticated shortcode injection in the All in One SEO (AIOSEO) WordPress plugin before 5.0.2.1 lets remote attackers
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputtin
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress. Rated high
Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress. Rated medium seve
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in ver
The All in One SEO - Best WordPress SEO Plugin - Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in ver
The All in One SEO - Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to
Exploit-DB