AIOSEO EUVD-2026-91907

Exploitation requires that the AIOSEO breadcrumb feature be actively rendered on the WordPress search results page - specifically via the AIOSEO breadcrumb block, widget, shortcode, or template tag. On sites that do not display AIOSEO breadcrumbs on search results, the vulnerable do_shortcode path is not reached and the issue is not exploitable. Where that condition is met, no authentication or user interaction is needed (PR:N/UI:N): an unauthenticated attacker can supply the malicious value remotely. The practical impact is further bounded by which shortcodes are registered on the target site, since arbitrary shortcode execution can only invoke shortcodes that core WordPress or installed plugins actually expose.

This is a moderate-risk issue that scores CVSS 6.5 (Medium) rather than critical, and the real-world signals support treating it as important-but-not-emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates a network-reachable, unauthenticated flaw with only Low confidentiality and Low integrity impact and no availability impact - consistent with arbitrary shortcode execution (CWE-94) whose blast radius depends on which shortcodes the installed plugins expose, not guaranteed full code execution. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list and there is no public exploit identified at time of analysis, so despite the 'RCE/Code Injection' tags this is not confirmed active exploitation. A key tension: the Tags label this 'RCE', but the CVSS impact (C:L/I:L, no system compromise metric elevated) and the description ('execute arbitrary shortcodes') point to shortcode injection, which is materially weaker than true remote code execution - treat the RCE framing with caution. The most significant risk-limiting factor is the precondition: the AIOSEO breadcrumb must actually be rendered on the search results page (via block, widget, shortcode, or template tag), which is a deployment-dependent configuration and not universal, meaning exploitation is opportunistic against sites meeting that condition rather than blanket-exploitable. No SSVC decision data was supplied.

An unauthenticated attacker crafts a WordPress search query (or otherwise influences the search results page) on a site where the AIOSEO breadcrumb is rendered on that page, injecting shortcode syntax that the plugin passes to do_shortcode without proper validation. When the breadcrumb renders, the injected shortcode executes in the site's context, potentially invoking any shortcode registered by WordPress core or other installed plugins. No public exploit code has been identified at the time of analysis, and because attack complexity is low the primary barrier is the required breadcrumb-rendering configuration.