CVE-2026-109367
Received Received - Intake

Sensitive Information Exposure in All in One SEO WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers to extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-109367
EUVD
EUVD-2026-114673

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the All in One SEO WordPress plugin allows unauthenticated attackers to access sensitive information by exploiting the 's' parameter. It exposes non-public post meta values, including custom fields like API keys and internal notes, through the HTML title and JSON-LD schema.

Detection Guidance

Check WordPress sites using the All in One SEO plugin for exposed sensitive data via the 's' parameter. Inspect HTML title elements and JSON-LD schema for non-public post meta values. Use tools like curl to query endpoints: curl 'https://example.com/?s=test' and review responses for sensitive information.

Impact Analysis

Attackers could steal sensitive data such as API keys or internal notes from your WordPress site. This may lead to further attacks, data breaches, or unauthorized access to other systems using exposed credentials.

Compliance Impact

This vulnerability could lead to unauthorized exposure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Update the All in One SEO plugin to the latest version beyond 5.0.3. If an update is unavailable, consider disabling the plugin temporarily. Monitor network traffic for suspicious queries targeting the 's' parameter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart