CVE-2021-25037 All In One SEO < 4.1.5.3 - Authenticated SQL Injection

2022-01-1713:00:36

CWE-89

WPScan

www.cve.org

cve-2021

all in one seo

authenticated

sql injection

wordpress

plugin

jetpack scan

database

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

46.8%

JSON

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).

CNA Affected

[
  {
    "product": "All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.1.3.1*",
        "status": "affected",
        "version": "4.1.3.1",
        "versionType": "custom"
      },
      {
        "lessThan": "4.1.5.3",
        "status": "affected",
        "version": "4.1.5.3",
        "versionType": "custom"
      }
    ]
  }
]