CVE-2025-58650

MediumCVSS 5.4

Published: 22/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The All In One SEO Pack plugin (versions up to and including 4.8.7.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. A low-privileged user may perform actions they should not have access to.

Risk Assessment

An attacker could bypass access control mechanisms and perform unauthorized operations, potentially leading to modification of SEO settings or information disclosure.

Recommendation

Update the All In One SEO Pack plugin to a version newer than 4.8.7.1 as soon as a fix is available. Until then, consider restricting site access or disabling the plugin.

Other vulnerabilities in All In One SEO Pack

CVE-2025-58649Medium
The All In One SEO Pack plugin (versions up to and including 4.8.7.1) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data. An attacker may gain access to information that should not be disclosed.

Original NVD description (English source)

Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS