Description

Marc-Alexandre Montpas reported two privilege escalation vulnerabilities in the WordPress plugin All in One SEO Pack. If your site has subscribers, authors and non-admin users logging in to wp-admin, you are a risk. If you have open registration, you are at risk, so you have to update the plugin now.

Remediation

Upgrade to the latest version of All in One SEO Pack (this problem was fixed in version 2.1.6).

References

All In One SEO Pack Release History

Related Vulnerabilities

WordPress Plugin Web Application Firewall-website security Privilege Escalation (2.1.1)

WordPress Plugin MasterStudy LMS-for Online Courses and Education Privilege Escalation (3.3.1)

node-serialize Insecure Deserialization

WordPress Plugin WP Project Manager-Task, team, and project management featuring kanban board and gantt charts Privilege Escalation (2.6.4)

XML external entity injection (variant)

Severity

High

Classification

CWE-269 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Privilege Escalation