Short answer
The All in One SEO WordPress plugin had two medium-severity security flaws, and both are now fixed in new releases. One lets unauthenticated attackers run commands under certain conditions; the other lets them inject malicious scripts. Sites using the plugin should update to the latest version and check which version they run.
Highlights
- The plugin has more than 2 million active installations.
- The shortcode flaw affects all versions up to 5.0.2; the script-injection flaw affects versions up to 5.0.1.1.
- Fixes shipped in 5.0.2 and 5.0.2.1; the recommended minimum is 5.0.2.1.
2 min readAuthor: UNIT Journal EditorEditor-in-chief: Uğur Deniz İlhan
Search Engine Journal reports that two security vulnerabilities have been disclosed in All in One SEO (AIOSEO), one of the most widely used SEO plugins for WordPress. The plugin has more than 2 million active installations, so many company sites are affected.
What do the flaws actually do?
The first flaw, rated 6.5 (medium), affects all versions up to 5.0.2. It lets unauthenticated attackers run WordPress shortcodes under certain conditions. According to Wordfence, it requires the plugin's breadcrumb component to be displayed on the search results page.
The second, rated 6.1 (medium), affects versions up to 5.0.1.1. It is a DOM-based cross-site scripting (XSS) flaw, where a malicious script runs through a crafted URL. It also requires a user with SEO management permission to open the SEO Preview panel in the admin area while visiting that URL.
Which version contains the fix?
The script-injection flaw was fixed in version 5.0.2 and the shortcode flaw in version 5.0.2.1. The source recommends moving to 5.0.2.1 or newer to cover both.
What should companies with WordPress sites do?
The source only recommends updating the plugin. The steps below are our own suggestions:
- Check the All in One SEO version on your WordPress Plugins page and update to 5.0.2.1 or newer.
- If an agency or software team manages your site, ask them to confirm the version in writing.
- Review who holds SEO management permission on your site, remove unnecessary access and use two-step verification on admin accounts.
- Set a regular schedule for plugin updates and do not leave security patches waiting for weeks.
Frequently asked
- How do I know if I am affected?
- If your plugin version is older than 5.0.2.1, you are within an affected range. Updating closes both flaws; if you notice unexpected content or redirects on your site, tell your software team.
Sources
- Search Engine Journal ·
Follow UNIT Journal
What's new in search, AI and technology, in your feed every day.
