CVE-2026-10755
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The All in One SEO WordPress plugin before version 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
Risk Assessment
The risk is potential manipulation of SEO settings by unauthorized users, which could lead to plugin malfunction and potential search engine ranking drops.
Recommendation
It is recommended to update the All in One SEO plugin to version 4.9.9 or later, which includes a fix restricting access to REST API endpoints.
Original NVD description (English source)
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.