{"id":"CVE-2026-10755","aliases":["EUVD-2026-45878","GHSA-8hj6-5c8v-39ff"],"status":"published","title":"All in One SEO \u003c 4.9.9 – Contributor+ Incorrect Authorization via AI Integration","description":"The All in One SEO  WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00281,"percentile":0.20817,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-07-20T06:00:02Z","modified":"2026-07-21T18:51:56Z","products":[{"vendor":"unknown","product":"all in one seo"}],"references":[{"url":"https://wpscan.com/vulnerability/cc4e83e3-b581-4f65-ac2c-24fbfb9da4b3/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10755"},{"url":"https://wpscan.com/vulnerability/cc4e83e3-b581-4f65-ac2c-24fbfb9da4b3"},{"url":"https://github.com/advisories/GHSA-8hj6-5c8v-39ff"}],"sources":{"cve":[{"id":"CVE-2026-10755","title":"All in One SEO \u003c 4.9.9 – Contributor+ Incorrect Authorization via AI Integration","description":"The All in One SEO  WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.","status":"published","published":"2026-07-20T06:00:02.224Z","modified":"2026-07-20T13:17:03.527Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-45878","description":"The All in One SEO  WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.","status":"published","published":"2026-07-20T06:00:02Z","modified":"2026-07-20T13:17:03Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:19:49.035342Z"}],"ghsa":[{"id":"GHSA-8hj6-5c8v-39ff","title":"The All in One SEO  WordPress plugin before 4.9.9 does not correctly restrict access to some of...","description":"The All in One SEO  WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.","status":"published","published":"2026-07-20T09:31:07Z","modified":"2026-07-20T15:33:08Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:09:36.920272Z"}],"nvd":[{"id":"CVE-2026-10755","description":"The All in One SEO  WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.","status":"published","published":"2026-07-20T07:16:34.443Z","modified":"2026-07-21T18:51:56.15Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:31.024898Z"}]}}