CVE-2026-10755

2.7 lowEPSS 0.3%

Low (2.7). EPSS 0.3% chance of exploitation in the next 30 days.

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.

Severity

CVSS 3.1

2.7 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-07-20
Modified: 2026-07-21
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/cc4e83e3-b581-4f65-ac2c-24fbfb9da4b3/

Check your stack JSON