PT-2026-47122 · WordPress · All-In-One Security

Dmitry Ignatyev · CVE-2026-8438 · Published 2026-06-06 · Updated 2026-06-28

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions All-In-One Security (AIOS) – Security and Firewall plugin for WordPress versions prior to 5.4.8

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization in the get rest route() function and missing output escaping in the column default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps disallow unauthorized rest requests) and debug logging (aiowps enable debug) are both enabled, an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($ SERVER['REQUEST URI']), which decodes payloads into literal HTML characters. This unsanitized value is stored in the database and subsequently executed in an administrator's browser session when they view the AIOS Dashboard Debug Logs page. This can lead to nonce theft, privileged AJAX/REST actions, and full site compromise.

Recommendations Update the plugin to a version later than 5.4.7. As a temporary workaround, disable the aiowps enable debug debug logging or the aiowps disallow unauthorized rest requests feature to prevent the storage and execution of malicious scripts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8438

Affected Products

All-In-One Security

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2026-8438 · Security Note
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-general-init-tasks.php#L887 · Note
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/admin/wp-security-list-debug.php#L43 · Note
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-debug-logger.php#L81 · Note
• https://twitter.com/integ_sec/status/2071205742606950856 · Twitter Post
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-utility.php#L1547 · Note
• https://t.me/CVEtracker/56042 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d2b7ed73-a654-40ef-8d80-6171393da8e7?source=cve · Note
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php#L887 · Note
• https://twitter.com/CVEnew/status/2063584079061078361 · Twitter Post
• https://t.me/cveNotify/166336 · Telegram Post
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-debug-logger.php#L81 · Note
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-utility.php#L1547 · Note
• https://plugins.trac.wordpress.org/changeset/3558989 · Note
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-debug.php#L43 · Note