Industry Newswordpress pluginaioseomissing authorization
AIOSEO Exposes Global AI Access Token
|
9.2
Wordfence disclosed a vulnerability in the All in One SEO (AIOSEO) WordPress plugin that allowed contributor-level users to retrieve a site's global AI access token, affecting versions up to 4.9.2. The flaw, a missing capability check on the /aioseo/v1/ai/credits REST endpoint, could let attackers generate content or exhaust AI credits. AIOSEO fixed the issue in version 4.9.3; the plugin is installed on over 3 million sites.
Scoring Rationale
High scope and clear remediation across three million installs; limited by no reported widespread exploitation.
Practice interview problems based on real data
1,500+ SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
