A security vulnerability has been discovered with the popular WordPress plugin, All in One SEO, potentially enabling attackers to misuse the software’s artificial intelligence features. If you have this plugin installed on your site, it is recommended that you update to the latest version now.
What is the nature of the vulnerability?
The issue has been named and catalogued by the Common Vulnerabilities and Exposures (CVE) system as CVE-2025-14384. It affects All in One SEO versions up to and including 4.9.2. The core issue is a missing authorisation check within one of the plugin’s REST API endpoints.
Specifically, a route used to retrieve information about AI credits did not properly verify user capabilities. As a result, any authenticated user with Contributor level access or higher could access sensitive data that should have been restricted to administrators.
This data included the site’s global AI access token, which is used by All in One SEO to communicate with its AI-powered services.
How this might affect your business
The risk with this vulnerability is not data theft in the traditional sense, but misuse of the plugin users’ paid resources. The exposed token could potentially be used to consume AI credits associated with the affected site, potentially leading to unexpected costs and disruption to SEO workflows.
Update your plugins as soon as possible
Security vulnerabilities in major plugins such as this one are a reminder of the importance of keeping your WordPress core, theme, and plugins up to date. If you have an external supplier or internal website manager, ask them to check if this plugin is installed and if it needs updating. This is also a good opportunity to check if any other plugins need upgrading and if your site’s general security is in good shape.
Need assistance updating your site?
If you are not currently working with a supplier to maintain your WordPress site, and you are unsure how to go about strengthening its security, I can help you with that. Arrange a consultation with me using my quick online form.
0 Comments