# All in One SEO <= 5.0.4 - Authenticated (Administrator+) Privilege Escalation via Multisite 'blogId' Parameter

- **ID:** WPSEC-2026-2588
- **Plugin:** All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) (`all-in-one-seo-pack`), https://wordpress.org/plugins/all-in-one-seo-pack/
- **Affected versions:** from 4.4.2 before 5.0.5
- **Fixed in:** 5.0.5 (Update to 5.0.5 or later.)
- **Severity:** Low 3.0 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/all-in-one-seo-pack
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2588/

## Description

The All in One SEO plugin for WordPress is vulnerable to Privilege Escalation via the 'blogId' parameter of the 'tools/import-robots-txt' REST endpoint in versions 4.4.2 up to, and including, 5.0.4. This is due to the endpoint checking the required capability only on the current site and then switching to whichever blog the request names, or writing to the network-level options when 'network' is passed. This makes it possible for authenticated attackers with administrator-level access to a single site on a multisite network, who are not super admins, to import arbitrary robots.txt rules into other sites in the network or into the network-wide robots.txt settings. Only multisite installations are affected.

## References

- https://wpsec.com/vuln/WPSEC-2026-2588/
- https://plugins.svn.wordpress.org/all-in-one-seo-pack/tags/5.0.5/
- https://wordpress.org/plugins/all-in-one-seo-pack/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2588/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.