CVE-2026-10755: All in One SEO Auth Bypass Vulnerability

CVE-2026-10755 Overview

CVE-2026-10755 is a broken access control vulnerability in the All in One SEO WordPress plugin versions prior to 4.9.9. The plugin fails to correctly restrict access to several AI integration REST API endpoints. Authenticated users with low-level privileges, such as Contributors, can overwrite or reset the site-wide AI integration state. The flaw is categorized under CWE-863: Incorrect Authorization. The WPScan Vulnerability Report documents the issue and its impact on affected installations.

Critical Impact
Contributor-level authenticated users can tamper with the site-wide AI integration configuration by invoking REST API endpoints that lack proper capability checks.

Affected Products

All in One SEO WordPress plugin versions before 4.9.9
WordPress sites running the vulnerable plugin with Contributor or higher accounts
Multi-author WordPress deployments using AI integration features

Discovery Timeline

2026-07-20 - CVE-2026-10755 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-10755

Vulnerability Analysis

The All in One SEO plugin exposes REST API endpoints related to its AI integration features. These endpoints modify or reset the plugin's site-wide AI integration state. The plugin does not enforce sufficient capability checks on these endpoints. Any authenticated user with at least Contributor privileges can invoke them.

Contributors in WordPress are intended to draft posts, not to alter site-wide plugin configuration. The vulnerability allows these low-privileged users to overwrite the AI integration state or reset it entirely. This affects data integrity of the plugin configuration across the entire site. Confidentiality and availability are not directly impacted based on the assigned metrics.

Root Cause

The root cause is missing or insufficient authorization logic on REST API route handlers. WordPress REST endpoints must implement a permission_callback that verifies the user's capability. In the vulnerable versions, the callback either grants access to any logged-in user or checks only for authentication rather than for a privileged capability such as manage_options.

Attack Vector

An attacker must first obtain valid credentials for a Contributor account or higher. The attacker then sends authenticated HTTP requests to the plugin's AI integration REST endpoints. Because the permission callback does not verify administrative capabilities, the request succeeds. The attacker can overwrite or reset the AI integration state used across the site.

No verified proof-of-concept code is publicly available. Refer to the WPScan Vulnerability Report for technical details on the affected endpoints.

Detection Methods for CVE-2026-10755

Indicators of Compromise

Unexpected changes to the All in One SEO AI integration configuration without administrator action
REST API requests to /wp-json/aioseo/ AI integration routes originating from non-administrator accounts
Audit log entries showing Contributor accounts modifying plugin options
Plugin AI integration state repeatedly reset or reconfigured outside change windows

Detection Strategies

Monitor WordPress REST API access logs for requests to All in One SEO AI endpoints by low-privileged users
Compare current plugin option values against a known-good baseline for aioseo_options in the database
Enable WordPress audit logging plugins to record plugin option changes and REST API invocations
Alert on authenticated REST API traffic where the requesting user role is below Editor and the target endpoint modifies plugin state

Monitoring Recommendations

Ingest WordPress application logs and web server access logs into a centralized SIEM for correlation
Track baseline REST API usage per user role and alert on deviations, particularly Contributor-issued POST requests
Review Contributor and Author account activity for signs of credential compromise or insider misuse

How to Mitigate CVE-2026-10755

Immediate Actions Required

Update the All in One SEO WordPress plugin to version 4.9.9 or later on all WordPress installations
Audit existing Contributor, Author, and Editor accounts for legitimacy and rotate credentials where suspicious activity is observed
Review current AI integration settings in the plugin and restore intended values if tampering is suspected

Patch Information

The vendor fixed the vulnerability in All in One SEO version 4.9.9. The patch adds proper capability checks to the affected REST API route handlers, restricting AI integration state modification to users with administrative privileges. See the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily restrict Contributor account creation until the plugin is updated
Use a Web Application Firewall to block unauthenticated and low-privilege access to /wp-json/aioseo/ AI integration endpoints
Disable the All in One SEO plugin on sites where updating is not immediately feasible and AI integration features are in use

bash

# Update All in One SEO via WP-CLI to remediate CVE-2026-10755
wp plugin update all-in-one-seo-pack --version=4.9.9
wp plugin get all-in-one-seo-pack --field=version