All in One SEO
Moderate fix1 remedy
cpe:2.3:a:semperfiwebdesign:all_in_one_seo_pack:*:*:*:*:wordpress:*:*, +1 more
Moderate fix1 remedy
- <= 4.9.2
All in One SEO WordPress Plugin Missing Authorization Vulnerability Allowing Data Disclosure
Vulnerability
Patched
A vulnerability exists in the All in One SEO WordPress plugin, specifically in the 'Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic' version 4.9.2 and prior. The issue arises from a missing capability check on the '/aioseo/v1/ai/credits' REST route, which allows authenticated attackers with Contributor-level access and above to access and disclose the global AI access token.
Impact
Exploitation of this vulnerability allows for unauthorized disclosure of the global AI access token.
Remediation
Users can update to version 4.9.3 or a newer patched version to address this vulnerability.
Added: Jan 16, 2026, 5:23 AM
Updated: Jan 16, 2026, 5:23 AM
Vulnerability Rating
Custom Algorithm
spread
7.6impact
2.5exploitability
6.1remediation
7.7relevance
2.1threat
3.2urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.