Missing Authorization Vulnerability in All In One SEO Pack by Syed Balkhi
CVE-2025-58650

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
All In One Seo Pack
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58650?

A missing authorization vulnerability exists in the All In One SEO Pack, developed by Syed Balkhi. This flaw allows an attacker to exploit improperly configured access control security levels, potentially granting unauthorized access to sensitive features. This vulnerability affects All In One SEO Pack versions up to 4.8.7, thereby risking the integrity and security of WordPress installations that utilize this plugin.

Affected Version(s)

All In One SEO Pack <= 4.8.7

References

https://patchstack.com/database/wordpress/plugin/all-in-o...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abu Hurayra (Patchstack Alliance)
JSON
.