Sensitive Information Exposure in All in One SEO Plugin for WordPress
CVE-2026-109367
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 October 2026
What is CVE-2026-109367?
The All in One SEO plugin for WordPress contains a vulnerability that permits attackers to access sensitive non-public post metadata. This issue, affecting versions up to 5.0.3, occurs through the 's' parameter, leading to the exposure of confidential information such as API keys and internal notes directly in the HTML title element and JSON-LD schema. Unauthorized users can exploit this flaw to extract valuable data, which poses significant risks to the integrity and security of affected WordPress installations.
Affected Version(s)
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) 0 <= 5.0.3