株式会社mgn@mgn_jpn
🛠 All in One SEO の脆弱性が修正されました（深刻度 中） 300万サイト以上が利用 / CVSS 5.3 5.0.4 に更新してください https://shindan.m-g-n.me/alerts/cve-2026-109367/
0701261.6K
504 followersView on X
CVE-2026-109367
LOWCVSS 5.3 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers to extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema.
0.0/ 10 priority
Sources & remediation
Other references
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Meta/Helpers.php#L95
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Meta/Title.php#L116
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1214
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1393
- https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1494
Weakness type (CWE)
CWE-200
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
Threat summary
- 2 mentions across 2 observed days
- Momentum state: stable
What's happening
- Peaked 1d ago at 1 mentions (2026-10-31); latest day: 1
- 2 total mentions across 2 days
Deep dive
Activity timeline2 mentions / 2d
Referenced assets2 URLs
Full discourse2 posts
CVE@CVEnewCVE-2026-109367 The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to Sensitive Infor… https://www.cve.org/CVERecord?id=CVE-2026-109367
0000049358.6K followersView on X