What’s Vulnerable › Vulnerabilities
CVE-2026-10755: All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration
- Severity: low (CVSS 2.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-20 · updated 2026-07-21
- Weakness: CWE-863
Description
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
Affected products
- smub All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic: before 4.9.9 — fixed in 4.9.9
How to fix
Upgrade to a fixed version: smub All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic 4.9.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-10755 or the next vulnerability affects your stack