CVE-2026-10755: All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/all-in-one-seoto a version that resolves this vulnerability.Fixed in 4.9.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10755?
The severity of CVE-2026-10755 is rated as low with a score of 2.7.
How do I fix CVE-2026-10755?
To fix CVE-2026-10755, update the All in One SEO WordPress plugin to version 4.9.9 or later.
What type of attack does CVE-2026-10755 allow?
CVE-2026-10755 allows users with low-level privileges, such as Contributors, to overwrite or reset the site-wide AI integration state.
Which plugin is affected by CVE-2026-10755?
The All in One SEO WordPress plugin is affected by CVE-2026-10755.
When was CVE-2026-10755 published?
CVE-2026-10755 was published on July 20, 2026.