CVE-2026-10755

—

CVSS 3.1

2.7 low

EPSS

<1%p20

Published

Jul 20, 2026 (Jul 20, 2026)

Modified

Jul 21, 2026

Description

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.

Ecosystems: WordPress
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.