CVE-2026-10755

All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration

Low · published July 20, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Published
2026-07-20T06:00Z
EPSS history
Timeline
  • 20 JUL 06:00Z
    All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration
    cvelistv5