What is the CVSS score of CVE-2026-10755?

CVE-2026-10755 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-10755?

Yes, a public proof-of-concept exploit is available for CVE-2026-10755. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-10755?

Yes, a patch is available for CVE-2026-10755. Update the affected software to the latest version immediately.

All in One SEO CVE-2026-10755

EUVD-2026-45878 LOW

Incorrect Authorization (CWE-863)

2026-07-20 WPScan

GHSA-8hj6-5c8v-39ff

WordPress Authentication Bypass All In One Seo Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Contributors are low-privilege users (PR:L), not high-privilege; AV:N reflects REST API access; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 14:23 vuln.today

CVSS changed

Jul 20, 2026 - 14:22 NVD

2.7 (LOW)

Patch available

Jul 20, 2026 - 09:17 EUVD

CVE Published

Jul 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 20, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.

AnalysisAI

Incorrect authorization on REST API endpoints in the All in One SEO WordPress plugin (before 4.9.9) allows authenticated users with low-level roles such as Contributor to overwrite or reset the site-wide AI integration configuration. The flaw is classified under CWE-863 (Incorrect Authorization), meaning the plugin registers REST API routes without enforcing appropriate role checks before permitting state-modifying operations. A publicly available proof-of-concept exists per WPScan, though no active exploitation has been confirmed by CISA KEV. The practical blast radius is limited to integrity of the plugin's AI settings, with no evidence of confidentiality or availability impact.

Technical ContextAI

All in One SEO is a widely deployed WordPress plugin that exposes REST API endpoints for managing AI-assisted SEO features. The root cause is CWE-863 (Incorrect Authorization): the plugin registers one or more REST API routes that perform privileged write operations (overwrite or reset AI integration state) but fails to enforce that only high-privilege roles (e.g., Administrator or Editor) may call them. Because WordPress's permission model distinguishes roles from Subscriber through Administrator, Contributors - who can draft posts but hold no administrative capabilities - should not have write access to site-wide plugin configuration. The CPE string (cpe:2.3:a:unknown:all_in_one_seo:*:*:*:*:*:*:*:*) confirms the affected product, though the vendor field is listed as 'unknown' in NVD, which is a minor data-quality gap. The vulnerability is network-reachable via the WordPress REST API, which is typically accessible without IP restriction on public-facing installations.

RemediationAI

Update the All in One SEO plugin to version 4.9.9 or later, as confirmed by the WPScan advisory (https://wpscan.com/vulnerability/cc4e83e3-b581-4f65-ac2c-24fbfb9da4b3/) and EUVD-2026-45878. Patched releases are available through the official WordPress plugin repository. If immediate patching is not feasible, sites should audit and restrict Contributor-level accounts, removing any untrusted or unnecessary contributor registrations. As an additional compensating control, REST API access can be restricted via a Web Application Firewall or server-level rules to block unauthenticated and low-privilege access to the plugin's AI integration endpoints; however, this may break legitimate plugin functionality and should be tested in a staging environment before production deployment. Site administrators should also review the current AI integration state for unexpected modifications to confirm no unauthorized changes were made prior to patching.