CVE-2025-12847

🗓️ 15 Nov 2025 05:45:32Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 47 Views🌐 WEB

CVE-2025-12847: All in One SEO lets contributors delete media via REST without ownership checks.

Reporter	Title	Published	Views	Family All 9
CNNVD	WordPress plugin All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic 安全漏洞	15 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-12847 All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion	15 Nov 202505:45	–	cvelist
EUVD	EUVD-2025-197686	15 Nov 202506:30	–	euvd
NVD	CVE-2025-12847	15 Nov 202506:15	–	nvd
Patchstack	WordPress All in One SEO plugin <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion vulnerability	14 Nov 202523:26	–	patchstack
Positive Technologies	PT-2025-47041	15 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12847	16 Nov 202505:51	–	redhatcve
Vulnrichment	CVE-2025-12847 All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion	15 Nov 202505:45	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (November 10, 2025 to November 16, 2025)	20 Nov 202516:10	–	wordfence

Vulners

Node

smub all_in_one_seo_powerful_seo_plugin_to_boost_seo_rankings_&_increase_trafficRange≤4.8.9wordpress

[
  {
    "vendor": "smub",
    "product": "All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.8.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Ai/Image.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Utils/Access.php
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Api/Ai.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/05abc09f-903b-45a9-8cde-1bf8fd5d7d44
plugins	www.plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Api/Api.php

Parameter	Position	Path	Description	CWE
id	request body	/wp-json/aioseo/v1/ai/image-generator	Unauthorized arbitrary media attachment deletion via the REST API endpoint due to insufficient authorization checks (requires only edit_posts capability) enabling contributors+ to delete attachments by ID.	CWE-862

17 Jun 2026 08:33Current

5Medium risk

Vulners AI Score5

CVSS 3.14.3

EPSS0.00206

SSVC

CWE-862