All in One SEO CVE-2026-109367

Exploitation requires only an unauthenticated HTTP request carrying the 's' (search) parameter to a site running All in One SEO ≤5.0.3; PR:N/UI:N confirms no authentication or user interaction is needed against the plugin's default search/schema output. The concrete prerequisite for sensitive impact is that the target site actually stores secrets (API keys, internal notes) in non-public post meta that the plugin then emits into the HTML title element and the JSON-LD SearchResultsPage schema - if no such meta exists, the disclosure yields no secrets. Limiting factors: impact is bounded to confidentiality of post meta the plugin surfaces (C:L, no integrity or availability effect), and the value of the leak depends entirely on what custom fields the specific deployment holds; the available sources do not state whether the schema/title emission depends on a non-default configuration setting, so that cannot be confirmed.

The input CVSS of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) describes a remote, low-complexity, unauthenticated confidentiality-only issue - a realistic but not catastrophic severity. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and there is no public exploit identified at time of analysis, so this is neither confirmed active exploitation nor confirmed weaponization. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a serious-but-not-urgent posture. The practical risk is somewhat higher than the medium CVSS suggests because the data disclosed is not merely low-sensitivity: the description states API keys and internal notes stored in non-public post meta can be extracted verbatim, so a 'Low' confidentiality metric understates the downstream consequence when secrets leak. Offsetting this, the attacker must be able to reach a site where such secrets are actually stored in post meta and where the plugin emits them, so impact is conditional on the target's data. Overall: a real, scannable, unauthenticated exposure worth patching within the stated this_month window, but not an emergency on current signals. Missing data to flag: no EPSS value and no KEV entry are present in the input, so exploitation likelihood is inferred from the CVSS vector and the ease of automation rather than measured.

An unauthenticated attacker sends a crafted search request using the 's' parameter to a WordPress site running All in One SEO ≤5.0.3; the plugin emits non-public post meta - including custom fields such as API keys and internal notes - verbatim into the HTML title element and the JSON-LD SearchResultsPage schema, which the attacker then reads directly from the response. Attack vector is network with low complexity and no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), making the request trivial to automate across many sites. No public exploit code is identified at time of analysis, though the technique requires only a standard HTTP GET.