CVE-2025-12847: All in One SEO Plugin Auth Bypass Vulnerability

CVE-2025-12847 Overview

CVE-2025-12847 affects the All in One SEO plugin for WordPress in all versions up to and including 4.8.9. The vulnerability stems from a missing authorization check in the /wp-json/aioseo/v1/ai/image-generator REST API endpoint. The endpoint verifies only the edit_posts capability without confirming ownership of the target media attachment. Authenticated attackers with Contributor-level access can permanently delete arbitrary media attachments by supplying valid attachment IDs. The flaw is categorized as Missing Authorization [CWE-862].

Critical Impact
Any authenticated user with Contributor privileges or higher can permanently delete arbitrary media attachments across the WordPress site, leading to content loss and site integrity impact.

Affected Products

All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic (WordPress plugin)
All versions up to and including 4.8.9
WordPress installations with Contributor-level accounts or above enabled

Discovery Timeline

2025-11-15 - CVE-2025-12847 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12847

Vulnerability Analysis

The All in One SEO plugin exposes a REST API route at /wp-json/aioseo/v1/ai/image-generator intended to manage AI-generated images. The handler performs a capability check for edit_posts, which is granted to Contributors and higher roles by default in WordPress.

The endpoint accepts an attachment ID and invokes deletion logic without verifying that the requester owns the attachment or has the delete_post capability for that specific object. As a result, the authorization boundary collapses to a coarse role check.

An attacker with a low-privileged Contributor account can enumerate attachment IDs, which are sequential integers, and send deletion requests to remove media belonging to administrators, editors, or other authors. The impact is limited to integrity of media assets; the flaw does not disclose data or grant code execution.

Root Cause

The root cause is a missing object-level authorization check [CWE-862] in the AI image generator REST route. The code confirms user role capability but omits per-object ownership validation before calling the WordPress media deletion function. The relevant logic resides in app/Common/Ai/Image.php, app/Common/Api/Ai.php, and app/Common/Utils/Access.php within the plugin source.

Attack Vector

Exploitation requires network access to the WordPress REST API and an authenticated session with at least Contributor privileges. The attacker issues an authenticated HTTP request to the vulnerable endpoint, referencing the numeric ID of a target attachment. No user interaction is required, and the attack can be scripted to iterate across many IDs. See the Wordfence Vulnerability Analysis for endpoint details.

No verified public proof-of-concept code is available. Review the WordPress Plugin API File and the WordPress Plugin Changeset for the patched code.

Detection Methods for CVE-2025-12847

Indicators of Compromise

Unexpected DELETE or POST requests to /wp-json/aioseo/v1/ai/image-generator in web server access logs
Missing media attachments in the WordPress Media Library without corresponding administrator action
REST API activity originating from Contributor or Author accounts that do not typically publish media
Bursts of sequential attachment ID references in request bodies targeting the AI image endpoint

Detection Strategies

Enable WordPress audit logging plugins to record attachment deletion events with actor identity
Correlate REST API request logs with the acting user's role and expected activity patterns
Alert on any Contributor-level account invoking aioseo/v1/ai/image-generator deletion actions
Baseline normal AIOSEO REST usage and flag deviations in request volume or source accounts

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM for query and retention
Monitor the wp_posts table for post_type = attachment rows removed outside administrative workflows
Track authentication events for low-privileged accounts that suddenly perform administrative-adjacent actions
Review file system activity in the wp-content/uploads/ directory for unexpected deletions

How to Mitigate CVE-2025-12847

Immediate Actions Required

Update the All in One SEO plugin to a version later than 4.8.9 that includes the fix referenced in the vendor changeset
Audit user accounts and revoke Contributor or higher privileges from accounts that do not require them
Review recent media deletion activity and restore attachments from backups where required
Enforce strong authentication and multi-factor authentication for all editorial accounts

Patch Information

The vendor addressed the vulnerability in the plugin release following 4.8.9. Details of the code change are visible in the WordPress Plugin Changeset. Administrators should apply the update through the WordPress plugin manager or via automated update policies.

Workarounds

Temporarily deactivate the All in One SEO plugin until the patched version is deployed
Restrict REST API access to the AIOSEO namespace using a web application firewall rule
Limit account creation and downgrade unnecessary Contributor accounts to Subscriber role
Maintain regular backups of the WordPress uploads directory and database to enable rapid restoration

bash

# Example WP-CLI commands to update the plugin and audit user roles
wp plugin update all-in-one-seo-pack
wp user list --role=contributor --fields=ID,user_login,user_email