Vulnerability · Published Jul 20, 2026 · Assigned by WPScan
CVE-2026-10755All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration
Low 2.7
In plain English
A low-severity incorrect authorization in All in One SEO from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | All in One SEO | 0 – before 4.9.9 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/cc4e83e3-b581-4f65-ac2c-24fbfb9da4b3/ exploit, vdb-entry, technical-description