CVE-2021-25037: All In One SEO < 4.1.5.3 - Authenticated SQL Injection
The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-25037?
CVE-2021-25037 is a vulnerability affecting the All in One SEO WordPress plugin before version 4.1.5.3.
What is the severity of CVE-2021-25037?
The severity of CVE-2021-25037 is medium, with a CVSS score of 6.5.
How can an attacker exploit CVE-2021-25037?
An attacker can exploit CVE-2021-25037 by injecting SQL commands into authenticated requests, potentially gaining access to sensitive information from the targeted site's database.
How do I fix CVE-2021-25037?
To fix CVE-2021-25037, update the All in One SEO WordPress plugin to version 4.1.5.3 or later, as the vulnerability has been patched in this release.
Are there any references for CVE-2021-25037?
Yes, you can find more information about CVE-2021-25037 at the following references: [Jetpack](https://jetpack.com/2021/12/14/severe-vulnerabilities-fixed-in-all-in-one-seo-plugin-version-4-1-5-3/), [WordPress Plugin Directory](https://plugins.trac.wordpress.org/changeset/2640944/all-in-one-seo-pack/trunk/app/Common/Api/PostsTerms.php), [WPScan](https://wpscan.com/vulnerability/4cd2a57b-3e1a-4acf-aecb-201ed9f4ee6d).