TI-2021-06599 Aliases CVE-2021-24307 GHSA-fg47-8fhh-p6fc

All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize

HIGH 70CWE-502Published 2021-05-24 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.

Why it matters now

EPSS 0.53274 98th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings (All in One SEO Team): 4.1.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
All in One SEO Team	All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings	4.1.0.2 to before 4.1.0.2	4.1.0.2	Patch available	CNA

All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings VendorAll in One SEO Team Affected 4.1.0.2 to before 4.1.0.2 Fixed in 4.1.0.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:aioseo:all_in_one_seo::::::wordpress::*	before 4.1.0.2	Vulnerable	aioseo

cpe:2.3:a:aioseo:all_in_one_seo:*:*:*:*:*:wordpress:*:* Versions before 4.1.0.2 Vulnerable ·aioseo

Remediation

Fix · CNA All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings (All in One SEO Team) Fixed in 4.1.0.2

Timeline

2026-10-02 Threatist record created from CVE-2021-24307
2026-10-03 Alias added: GHSA-fg47-8fhh-p6fc

References

Exploit 1

https://wpscan.com/vulnerability/ab2c94d2-f6c4-418b-bd14-711ed164bcf1

Advisory 1

https://aioseo.com/changelog/

TI-2024-03152 All in One SEO < 4.6.1.1 - Contributor+ Stored XSS CVSS 3.1MEDIUM 6.1
TI-2021-07314 All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation CVSS 3.1HIGH 8.8
TI-2022-17802 WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities CVSS 3.1HIGH 8.8
TI-2023-00555 All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
TI-2021-07315 All In One SEO < 4.1.5.3 - Authenticated SQL Injection CVSS 3.1MEDIUM 6.5
TI-2022-20687 WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability CVSS 3.1MEDIUM 6.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences