CONNECT WITH US
Tech

Tech

All In One SEO WordPress Plugin Vulnerable To Two Exploits via @sejournal, @martinibuster

Search Engine Journal logo

Published on

Add as a preferred source on Google
All In One SEO WordPress Plugin Vulnerable To Two Exploits via @sejournal, @martinibuster

A security warning was issued for AIOSEO WordPress Plugin. Two vulnerabilities enable unauthenticated attackers to compromise websites.

Two security vulnerabilities were disclosed in the All in One SEO WordPress plugin, which has over two million active installations. Both vulnerabilities enable unauthenticated attackers to execute arbitrary shortcodes or inject malicious scripts under specific conditions.

The All in One SEO (AIOSEO) WordPress plugin is a popular SEO plugin used by over 2 million users. It’s used to manage search engine optimization settings on WordPress websites. It also provides tools for managing XML sitemaps, structured data, redirects, internal links and content optimization. The plugin also includes tools for monitoring search rankings, auditing website SEO and generating content with AI.

The first vulnerability, rated 6.5 (Medium), affects all versions of AIOSEO up to and including 5.0.2. It enables unauthenticated attackers to execute arbitrary WordPress shortcodes when specific conditions are met.

What makes this vulnerability concerning is that attackers don’t need an account on the website or any level of user privileges to exploit it.

The vulnerability is caused by a missing validation check before the plugin runs the WordPress `do_shortcode` function.

Shortcodes are instructions that tell WordPress to perform specific functions, such as displaying content or running a feature. The `do_shortcode` function processes those instructions.

The security weakness is that the plugin doesn’t properly check a value before executing a shortcode, which makes it possible for an attacker to cause the website to execute arbitrary shortcodes.


Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.