Description
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | All in One SEO | < 4.9.9 | 4.9.9 |
References
- https://wpscan.com/vulnerability/cc4e83e3-b581-4f65-ac2c-24fbfb9da4b3/ exploit vdb-entry technical-description