Update Your All In One SEO Plugin For Security Patch

Gears with the letters "SEO"

Do you own and operate a WordPress website?  Do you also use the “All in One” SEO plugin?

If you answered yes to both of those questions, then be aware that you’ll want to update that plugin as soon as possible.

Recently security researcher Marc Montpas from Automattic Security discovered and reported a pair of critical security flaws.

These flaws put any website using the non-upgraded version of that plugin at risk. The security flaws are being tracked as CVE-2021-25036 and CVE-2021-25037 respectively. The first is an Authenticated Privilege Escalation bug and the second an Authenticated SQL Injection bug.

The bad news is that there are currently more than 800,000 websites running the outdated and vulnerable version of the plugin.  The good news is that the development team behind the All-in-One plugin responded very quickly and delivered an update to their product on December 7th of this year (2021) which addresses both issues.

The reason these flaws are so dangerous lies in the fact that all an attacker needs to be able to successfully execute an attack that leverages them is an authenticated account. That is generally a relatively easy thing to get.  It doesn’t have to have a lot of rights or privileges so a low-level permission group like “Subscriber” is sufficient.

Using that as a starting point it would be easy for an attacker to escalate his or her own privileges and cause all sorts of damage to the site itself or exfiltrate data from it.  Not good.

Now is the Time to Update Your All-in-One SEO Plugin

In any case there’s a simple solution ready and waiting.  Just check to see what version of the All-in-One plugin you’re using. If you don’t already have it download and install the patch.  Stay safe out there.  There may yet be a few additional surprises in store for us in what remains of the year.

Used with permission from Article Aggregator

style "OMG" on plain white background.
The Business Owner's Guide to Cybersecurity

Download the

Business Owner’s Guide to Cybersecurity

Browse Topics

An illustration of servers, a laptop, and a monitor showing a world map.

Business Continuity

A group of four people working on cybersecurity on a giant laptop.

Cloud Computing

A group of people working on a computer with a lock.


An illustration of a group of people discussing managed IT services at a table.

Managed IT Services

A man working on a laptop and a woman working on a giant smartphone with a cyber lock.

Tech Tips

A group of four people sitting at a round desk providing VoIP support services.

VoIP Phone Services