CVE-2026-100152 Overview
CVE-2026-100152 affects the All in One SEO (AIOSEO) plugin for WordPress, a widely deployed search engine optimization plugin. All versions up to and including 5.0.2 improperly handle user input before passing it to the do_shortcode function. Unauthenticated attackers can execute arbitrary WordPress shortcodes through the breadcrumb rendering logic. Exploitation requires the AIOSEO breadcrumb to be rendered on the search results page via block, widget, shortcode, or template tag. The flaw is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Unauthenticated attackers can trigger arbitrary shortcode execution on vulnerable WordPress sites where AIOSEO breadcrumbs render on search results pages, potentially exposing data or invoking privileged plugin functionality.
Affected Products
- All in One SEO Plugin for WordPress — all versions up to and including 5.0.2
- WordPress sites that render AIOSEO breadcrumbs on the search results page
- Deployments using the breadcrumb block, widget, shortcode, or template tag
Discovery Timeline
- 2026-10-03 - CVE-2026-100152 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-100152
Vulnerability Analysis
The vulnerability resides in the AIOSEO breadcrumb rendering path. When breadcrumbs are generated on the WordPress search results page, user-controlled input flows into the do_shortcode call without proper validation. WordPress exposes the search query via parameters such as s in the request URL, giving attackers a direct injection point. An attacker crafts a request containing a shortcode payload. The plugin then expands that shortcode server-side during breadcrumb rendering. Any shortcode registered on the target site becomes reachable, including shortcodes exposed by other installed plugins.
The practical impact depends on which shortcodes are available. Attackers can disclose restricted content, enumerate internal data, or trigger side effects implemented by third-party shortcodes. The attack requires no authentication and no user interaction beyond serving a crafted link.
Root Cause
The root cause is missing input validation before invocation of do_shortcode within the breadcrumb pipeline. The affected code paths include app/Common/Breadcrumbs/Breadcrumbs.php, app/Common/Breadcrumbs/Frontend.php, and app/Common/Breadcrumbs/Tags.php in version 5.0.2. The breadcrumb value derived from search queries is passed through shortcode expansion rather than being escaped or stripped. See the WordPress Change Set 3723760 for the vendor fix.
Attack Vector
The attack vector is network-based. An unauthenticated attacker sends an HTTP GET request to the vulnerable WordPress search endpoint with a shortcode payload in the search query parameter. If AIOSEO breadcrumbs render on the search results template, the plugin expands the shortcode on the server. The vulnerability is exploitable remotely without privileges or user interaction.
No verified exploitation code is publicly indexed for this CVE at publication time. Refer to the Wordfence Vulnerability Report for additional technical context.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-100152
Indicators of Compromise
- HTTP requests to /?s= or /search/ endpoints containing WordPress shortcode syntax such as [ and ] characters in the query string
- Access log entries where the s parameter contains strings matching \[[a-zA-Z0-9_-]+
- Unexpected shortcode output or plugin-generated content appearing in search results page HTML
Detection Strategies
- Inspect web server access logs for search queries containing bracketed shortcode names, prioritizing shortcodes exposed by sensitive plugins such as form, membership, or e-commerce extensions
- Apply WAF rules that flag or block requests where the s query parameter contains shortcode delimiters
- Compare installed AIOSEO plugin version against 5.0.2 and track whether breadcrumbs are configured on the search results template
Monitoring Recommendations
- Enable verbose logging on the WordPress search endpoint and forward logs to a centralized SIEM for correlation
- Monitor for anomalous rendering latency on search pages, which can indicate server-side shortcode expansion of expensive operations
- Track plugin inventory and version drift across managed WordPress properties to identify unpatched instances quickly
How to Mitigate CVE-2026-100152
Immediate Actions Required
- Update the All in One SEO plugin to the version that includes the fix referenced in WordPress Change Set 3723760
- If immediate patching is not possible, remove the AIOSEO breadcrumb block, widget, shortcode, or template tag from the search results template
- Audit installed plugins to inventory registered shortcodes that could be abused through this vector
Patch Information
The vendor patch modifies app/Common/Breadcrumbs/Frontend.php to validate input before shortcode processing. The fix is published in the plugin repository as change set 3723760. Review the change set diff and upgrade to the fixed release.
Workarounds
- Disable AIOSEO breadcrumbs on the search results template until the plugin is updated
- Deploy WAF rules that strip or reject [ and ] characters in the s search parameter
- Restrict access to the search endpoint to authenticated users on sites where public search is not required
# Example WAF rule (ModSecurity) to block shortcode syntax in search queries
SecRule ARGS:s "@rx \[[a-zA-Z0-9_-]+" \
"id:1026100152,phase:2,deny,status:403,msg:'CVE-2026-100152 AIOSEO shortcode injection attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
