Technology Tips

January 04, 2022

Update Your All In One SEO Plugin For Security Patch

Written By Securafy Team

Do you own and operate a WordPress website?  Do you also use the "All in One" SEO plugin?

If you answered yes to both of those questions, then be aware that you'll want to update that plugin as soon as possible.

Recently security researcher Marc Montpas from Automattic Security discovered and reported a pair of critical security flaws.

These flaws put any website using the non-upgraded version of that plugin at risk. The security flaws are being tracked as CVE-2021-25036 and CVE-2021-25037 respectively. The first is an Authenticated Privilege Escalation bug and the second an Authenticated SQL Injection bug.

The bad news is that there are currently more than 800,000 websites running the outdated and vulnerable version of the plugin.  The good news is that the development team behind the All-in-One plugin responded very quickly and delivered an update to their product on December 7th of this year (2021) which addresses both issues.

The reason these flaws are so dangerous lies in the fact that all an attacker needs to be able to successfully execute an attack that leverages them is an authenticated account. That is generally a relatively easy thing to get.  It doesn't have to have a lot of rights or privileges so a low-level permission group like "Subscriber" is sufficient.

Using that as a starting point it would be easy for an attacker to escalate his or her own privileges and cause all sorts of damage to the site itself or exfiltrate data from it.  Not good.

In any case there's a simple solution ready and waiting.  Just check to see what version of the All-in-One plugin you're using. If you don't already have it download and install the 4.1.5.3 patch.  Stay safe out there.  There may yet be a few additional surprises in store for us in what remains of the year.

Picture of Securafy Team
About The Author
Our team at Securafy brings you the best tech tips, from how-to guides and troubleshooting advice to software reviews and productivity hacks. We're all about empowering businesses with the tools and knowledge they need to thrive in the digital world. Follow our posts to stay equipped with practical insights that make tech work for you.

Subscribe to our newsletter

Sign up for our FREE "Cyber Security Tip of the Week!" and always stay one step ahead of hackers and cyber-attacks.