All in One SEO WordPress Plugin Incorrect Authorization Vulnerability in AI Integration REST API

A vulnerability exists in the All in One SEO WordPress plugin in versions prior to 4.9.9, where access to certain AI integration REST API endpoints is not properly restricted. This flaw allows users with low-level privileges, such as Contributors, to overwrite or reset the site-wide AI integration state.

Impact

Exploitation of this vulnerability allows for unauthorized users to modify the site's AI integration settings, potentially disrupting AI-related functionalities or workflows.

Reproduction

To reproduce this vulnerability, log in as a Contributor and capture the session cookies. Then, obtain a valid WordPress REST API nonce from a page that includes the wpApiSettings. With the nonce, send a POST request to the 'aioseo/v1/ai/auth' endpoint to overwrite the global AI access token, or use the 'aioseo/v1/ai/deactivate' endpoint to reset the site's AI integration state.

Remediation

Users are advised to update the All in One SEO WordPress plugin to version 4.9.9 or later.