{"id":"CVE-2021-24307","aliases":["EUVD-2021-11221","GHSA-fg47-8fhh-p6fc"],"status":"published","title":"All in One SEO Pack \u003c  4.1.0.2 - Admin RCE via unserialize","description":"The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with \"aioseo_tools_settings\" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section \"Tool \u003e Import/Export\". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.53274,"percentile":0.98991,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-502","CWE-94"],"published":"2021-05-24T10:58:05Z","modified":"2026-06-17T03:39:48Z","exploits":[{"source":"pocgithub","id":"darkpills/CVE-2021-24307-all-in-one-seo-pack-admin-rce","title":"darkpills/CVE-2021-24307-all-in-one-seo-pack-admin-rce","date":"2022-01-02","url":"https://github.com/darkpills/CVE-2021-24307-all-in-one-seo-pack-admin-rce"}],"products":[{"vendor":"aioseo","product":"all_in_one_seo"},{"vendor":"all in one seo team","product":"all in one seo – best wordpress seo plugin – easily improve your seo rankings"}],"references":[{"url":"https://wpscan.com/vulnerability/ab2c94d2-f6c4-418b-bd14-711ed164bcf1","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://aioseo.com/changelog/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24307"},{"url":"https://github.com/advisories/GHSA-fg47-8fhh-p6fc"}],"sources":{"cve":[{"id":"CVE-2021-24307","title":"All in One SEO Pack \u003c  4.1.0.2 - Admin RCE via unserialize","description":"The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with \"aioseo_tools_settings\" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section \"Tool \u003e Import/Export\". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.","status":"published","published":"2021-05-24T10:58:05Z","modified":"2024-08-03T19:28:23.581Z","cwes":["CWE-502"],"updated_at":"2026-11-02T14:33:05.331617Z"}],"euvd":[{"id":"EUVD-2021-11221","description":"The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with \"aioseo_tools_settings\" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section \"Tool \u003e Import/Export\". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.","status":"published","published":"2021-05-24T10:58:05Z","modified":"2024-08-03T19:28:23Z","updated_at":"2026-11-03T03:24:58.504484Z"}],"ghsa":[{"id":"GHSA-fg47-8fhh-p6fc","title":"The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2...","description":"The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with \"aioseo_tools_settings\" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section \"Tool \u003e Import/Export\". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.","status":"published","published":"2022-05-24T22:28:36Z","modified":"2023-01-30T05:05:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-502"],"updated_at":"2026-11-02T14:47:22.488805Z"}],"nvd":[{"id":"CVE-2021-24307","description":"The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with \"aioseo_tools_settings\" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section \"Tool \u003e Import/Export\". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.","status":"published","published":"2021-05-24T11:15:08.35Z","modified":"2026-06-17T03:39:48.257Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:53.987491Z"}]}}