CVE-2021-25036CWE-287

All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation

published January 17, 2022

CVSS
—
EPSS
3%
Percentile
87.4
In the wild
Unconfirmed
What it is

The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03033 · 87.4th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-01-17T13:00Z
EPSS history
Timeline
  • 17 JAN 13:00Z
    All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation
    cvelistv5