Read the docs
TI-2021-07314 Aliases CVE-2021-25036GHSA-cf7m-hm28-rpmp

All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation

Priority MEDIUM 44CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.

Why it matters now

EPSS 0.03033 87th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic (Unknown): 4.1.5.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAll in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic4.1.3.1 and later; 4.1.5.3 to before 4.1.5.34.1.5.3Patch availableCNA
  • All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic VendorUnknown Affected 4.1.3.1 and later; 4.1.5.3 to before 4.1.5.3 Fixed in 4.1.5.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:aioseo:all_in_one_seo:*:*:*:*:*:wordpress:*:*before 4.1.5.3Vulnerableaioseo
  • cpe:2.3:a:aioseo:all_in_one_seo:*:*:*:*:*:wordpress:*:* Versions before 4.1.5.3 Vulnerable ·aioseo

Remediation

  • Fix · CNA All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic (Unknown) Fixed in 4.1.5.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic 4.1.3.1*, 4.1.5.3

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-07315 All In One SEO < 4.1.5.3 - Authenticated SQL InjectionPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25036
  2. 2026-10-03 Alias added: GHSA-cf7m-hm28-rpmp

References

Exploit 2

Patch 1

  • TI-2021-06599 All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize CVSS 3.1HIGH 8.8
  • TI-2024-03152 All in One SEO < 4.6.1.1 - Contributor+ Stored XSS CVSS 3.1MEDIUM 6.1
  • TI-2022-17802 WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities CVSS 3.1HIGH 8.8
  • TI-2023-00555 All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
  • TI-2021-07315 All In One SEO < 4.1.5.3 - Authenticated SQL Injection CVSS 3.1MEDIUM 6.5
  • TI-2022-20687 WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences