CVE-2025-12847

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `/wp-json/aioseo/v1/ai/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.

• CWE-862

• https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Ai/Image.php#L192
• https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Api/Ai.php#L542
• https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Api/Api.php#L192
• https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Utils/Access.php#L184
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3393820%40all-in-one-seo-pack&old=3384131%40all-in-one-seo-pack&sfp_email=&sfph_mail=#file1387
• https://www.wordfence.com/threat-intel/vulnerabilities/id/05abc09f-903b-45a9-8cde-1bf8fd5d7d44?source=cve

Published

Nov 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12841The Bookit WordPress plugin before 2.5.1 has a publicly acce…5.3
• CVE-2025-12842The Booking Plugin for WordPress Appointments – Time Slot pl…5.3
• CVE-2025-12843Code Injection using Electron Fuses in waveterm on MacOS all…5.5
• CVE-2025-12844The AI Engine plugin for WordPress is vulnerable to PHP Obje…7.1
• CVE-2025-12845The Tablesome Table – Contact Form DB – WPForms, CF7, Gravit…8.8
• CVE-2025-12846The Blocksy Companion plugin for WordPress is vulnerable to …8.8
• CVE-2025-12848Webform Multiple File Upload module for Drupal 7.x contains …6.1
• CVE-2025-12849The Contest Gallery plugin for WordPress is vulnerable to au…5.3
• CVE-2025-1285The Resido - Real Estate WordPress Theme theme for WordPress…5.3
• CVE-2025-12850The My auctions allegro plugin for WordPress is vulnerable t…7.5
• CVE-2025-12851The My auctions allegro plugin for WordPress is vulnerable t…8.1
• CVE-2025-12852DLL Loading vulnerability in NEC Corporation RakurakuMusen S…8.4