All in One SEO <= 5.0.4 - Authenticated (Administrator+) Privilege Escalation via Multisite 'blogId' Parameter
- ID
- WPSEC-2026-2588
- Plugin
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) (all-in-one-seo-pack)
- Affected
- from 4.4.2 before 5.0.5
- Remediation
- Update to 5.0.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-05
- Attack surface
- All in One SEO on WPSec AttackSurface
- Fix released
- Published
Description
The All in One SEO plugin for WordPress is vulnerable to Privilege Escalation via the 'blogId' parameter of the 'tools/import-robots-txt' REST endpoint in versions 4.4.2 up to, and including, 5.0.4. This is due to the endpoint checking the required capability only on the current site and then switching to whichever blog the request names, or writing to the network-level options when 'network' is passed. This makes it possible for authenticated attackers with administrator-level access to a single site on a multisite network, who are not super admins, to import arbitrary robots.txt rules into other sites in the network or into the network-wide robots.txt settings. Only multisite installations are affected.
References
- https://wpsec.com/vuln/WPSEC-2026-2588/
- https://plugins.svn.wordpress.org/all-in-one-seo-pack/tags/5.0.5/
- https://wordpress.org/plugins/all-in-one-seo-pack/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS