PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5075 smub CVE debrief

The All in One SEO plugin for WordPress, versions up to and including 4.9.7, exposes sensitive internal option data through localized script variables in post editor contexts. The vulnerability stems from passing unmasked API/OAuth tokens and license-related values via `wp_localize_script()` to the browser, where contributor-level users and above can view them in page source. This represents an information disclosure weakness (CWE-200) rather than a direct authentication bypass or remote code execution flaw. The issue was disclosed on 2026-05-20 with a CVSS 3.1 score of 4.3 (Medium), reflecting the authenticated nature of the attack and limited confidentiality impact. A changeset addressing the issue has been committed to the plugin repository.

Vendor
smub
Product
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-24
Advisory published
2026-05-20
Advisory updated
2026-07-24

Who should care

WordPress site administrators using All in One SEO plugin; security teams managing content management system plugins; compliance officers concerned with API credential exposure; developers reviewing plugin security postures.

Technical summary

The plugin's use of `wp_localize_script()` to pass internalOptions data to the post editor fails to mask sensitive fields for users with contributor capabilities. This allows extraction of configured API/OAuth tokens and license values from rendered HTML/JS. The attack requires authenticated access with contributor privileges or higher, and exploitation leaves no server-side logs of credential access since data is exposed client-side.

Defensive priority

medium

Recommended defensive actions

  • Upgrade All in One SEO plugin to version 4.9.8 or later
  • Review user roles and remove unnecessary contributor access
  • Audit browser-accessible script data for sensitive values
  • Verify no API tokens have been exposed in cached page sources or version control
  • Consider rotating any OAuth or API credentials that may have been visible

Evidence notes

Official vulnerability database records indicate this issue was reported through Wordfence and affects plugin versions through 4.9.7. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-accessible, low-complexity exploitation requiring low privileges with no user interaction. The vulnerability status is currently marked as Deferred in NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5075 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5075

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5075 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5075

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.