CVE-2025-12847: All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint /wp-json/aioseo/v1/ai/image-generator only verifying that users have the editposts capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12847?
CVE-2025-12847 has a medium severity rating due to its potential for unauthorized access to media attachment deletion.
How do I fix CVE-2025-12847?
To fix CVE-2025-12847, update the All in One SEO plugin to version 4.9.0 or higher where the vulnerability is patched.
Who is affected by CVE-2025-12847?
CVE-2025-12847 affects all versions of the All in One SEO plugin for WordPress up to and including version 4.8.9.
What impact does CVE-2025-12847 have on WordPress sites?
CVE-2025-12847 allows unauthorized users to delete media attachments, potentially leading to data loss on affected WordPress sites.
Is there a way to mitigate CVE-2025-12847 if I cannot update immediately?
If you cannot update immediately, limit user permissions and access to the WordPress admin area to minimize exposure to CVE-2025-12847.