What the vulnerability does
01Description
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `/wp-json/aioseo/v1/ai/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.
Explanation of Vulnerability in Simple Terms
02Summary
All in One SEO versions up to 4.8.9 lack proper authorization checks, allowing authenticated users to modify site content they should not have access to. An attacker with a low-privilege account can alter data through the plugin's functions. The vulnerability requires an existing user account but no special interaction. Update to a version newer than 4.8.9.
What an attacker can do
03Attacker Capabilities
Modify site content or settings they lack permission to change.
Potential impact on your site
04Site Impact
Unauthorized users can alter SEO settings, metadata, or other plugin-controlled content.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
November 15, 2025
CVE published
April 8, 2026
Record updated
