PT-2026-42103 · WordPress · All In One Seo

Riadh Bouchahoua · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-5075

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 4.9.8

Description The All in One SEO plugin for WordPress allows sensitive internal option data to be passed to the wp localize script() function in post editor contexts without effective masking for low-privilege users. This leads to sensitive information exposure via the 'internalOptions' localized script data. Authenticated attackers with contributor-level access or higher can view configured API/OAuth tokens and license-related values by inspecting the page source.

Recommendations Update to a version newer than 4.9.7.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-5075

Affected Products

All In One Seo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5075 · Security Note
• https://t.me/cveNotify/164157 · Telegram Post
• https://t.me/CVEtracker/54348 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0d8bc203-c17a-4b31-8f9e-695f9e638cda?source=cve · Note
• https://twitter.com/CVEnew/status/2056994190714929164 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3532318/all-in-one-seo-pack · Note