What is the CVSS score of CVE-2026-5075?

CVE-2026-5075 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

All in One SEO CVE-2026-5075

EUVD-2026-31059 MEDIUM

Information Exposure (CWE-200)

2026-05-20 Wordfence

GHSA-wvqf-p272-v65m

WordPress Information Disclosure Wordpress Plugin All In One Seo Powerful Seo Plugin To Boost Seo Rankings Increase Traffic Smub

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 05:15 vuln.today

DescriptionCVE.org

The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and including, 4.9.7 due to sensitive internal option data being passed to wp_localize_script() in post editor contexts without effective masking for low-privilege users. This makes it possible for authenticated attackers, with contributor-level access and above, to view configured API/OAuth tokens and license-related values from page source.

AnalysisAI

Sensitive credential exposure in the All in One SEO WordPress plugin (versions up to and including 4.9.7) allows authenticated contributors to harvest API tokens, OAuth credentials, and license keys directly from rendered page source. The plugin passes unmasked internal configuration data to the browser via WordPress's wp_localize_script() mechanism in post editor contexts, making sensitive values accessible to any user with contributor-level access or above. No public exploit code or active exploitation has been identified at time of analysis, but exposed credentials carry secondary risk - compromised API/OAuth tokens could enable account takeover or abuse of connected third-party services.

Technical ContextAI

WordPress's wp_localize_script() function is a standard mechanism for passing PHP-side data to JavaScript as inline JSON variables embedded in page HTML. The affected plugin (identified via CPE cpe:2.3:a:smub:all_in_one_seo_-_powerful_seo_plugin_to_boost_seo_rankings_&_increase_traffic:*:*:*:*:*:*:*:*) included its full 'internalOptions' data structure - containing API keys, OAuth tokens, and license-related values - in this localized script output without filtering or redacting fields based on the viewing user's privilege level. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies directly: the data is legitimately present in the backend but incorrectly surfaced to low-privilege frontend consumers. The post editor context is the trigger; any contributor who can access the WordPress block or classic editor receives the unredacted payload in their browser's page source.

RemediationAI

The upstream fix is available via WordPress plugin Trac changeset 3532318 (https://plugins.trac.wordpress.org/changeset/3532318/all-in-one-seo-pack); however, the exact released plugin version number containing this fix was not independently confirmed from the provided data - verify the current release in the WordPress plugin repository and update to any version beyond 4.9.7 that incorporates this changeset. Additional context is available in the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8bc203-c17a-4b31-8f9e-695f9e638cda. As a compensating control prior to patching, restrict contributor-level role assignment to only trusted users and audit existing contributor accounts. Site administrators should immediately rotate any API keys, OAuth tokens, and license credentials configured within the plugin, as any contributor who accessed the post editor on affected versions may have already observed those values in page source.