All in One SEO CVE-2026-5075

Exploitation requires an authenticated WordPress session with contributor-level privileges or higher - confirmed by CVSS PR:L. The attacker must be able to access the WordPress post editor (block editor or classic editor), as the sensitive data is only injected by wp_localize_script() in that specific page context. No special plugin configuration or non-default settings are required beyond the plugin being installed and active with any API, OAuth, or license credentials configured. Exploitation is limited to users who already hold a WordPress account with at minimum contributor access; unauthenticated external attackers cannot reach this data. The exposure is passive - no active exploitation of the application is needed beyond page load.

The CVSS 4.3 Medium score reflects the constrained impact: AV:N confirms network reachability, AC:L indicates no special attack complexity, PR:L confirms low-privilege authentication is required, and S:U/C:L/I:N/A:N limits scope to a partial confidentiality loss with no integrity or availability impact. The real-world risk, however, may exceed the raw CVSS score in environments where the exposed credentials have significant downstream blast radius - an OAuth token or API key for a connected marketing or analytics platform could enable account takeover or data exfiltration well beyond what C:L implies. No EPSS score was provided, precluding probability-of-exploitation benchmarking. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified, indicating opportunistic exploitation is not currently widespread. The primary risk is insider threat or a low-privilege WordPress user deliberately targeting credentials - not external unauthenticated mass exploitation.

An attacker who has registered or compromised a WordPress account with contributor-level access navigates to the post editor on a site running All in One SEO 4.9.7 or earlier. By viewing the page source or using browser developer tools to inspect inline JavaScript, the attacker reads the 'internalOptions' object and extracts plaintext API keys, OAuth tokens, or license values. No public exploit code exists at time of analysis, but the technique requires only standard browser tooling and no special expertise.