WordPress Plugin Vulnerabilities

AI for SEO < 1.2.10 - Missing Authorization

Description

The AI for SEO – Bulk Generate Metadata, Alt Text, Image Titles, Captions, Descriptions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
ai-for-seo
Fixed in 1.2.10

References

CVE
CVE-2025-22299
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3121821e-676a-444e-8e5c-c0fff58bc6eb

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
7d0e8288-92e5-4906-b54d-78bd885f6a01

Timeline

Publicly Published
2025-01-06 (about 1 year ago)
Added
2025-01-15 (about 1 year ago)
Last Updated
2025-01-15 (about 1 year ago)

Other

Published
Title
Published
2025-12-21
Title
Wappointment <=2.7.2 - Missing Authorization
Published
2024-07-08
Title
EventON < 2.2.16 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates
Published
2025-11-04
Title
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce < 3.6.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
Published
2022-01-17
Title
WP Ultimate CSV Importer < 6.4.2 - Subscriber+ Arbitrary Option Deletion
Published
2025-10-14
Title
Welcart e-Commerce < 2.11.25 - Missing Authorization