The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAioseo All In One Seo
APPAioseo< 4.1.0.2
Powiązane podatności
The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was disc...
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vuln...
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields befor...
The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for Wor...
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple paramet...