CVE-2026-100152 in All in One SEO Plugin
Summary
by MITRE • 10/03/2026
The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in The All in One SEO plugin, specifically affecting versions up through 5.0.2, represents a significant security flaw rooted in improper input validation within the WordPress ecosystem. This issue is classified as an arbitrary shortcode execution vulnerability, which allows unauthenticated attackers to inject and execute malicious shortcodes on affected websites. The core technical failure lies in the software's handling of user-supplied data during the rendering process for breadcrumbs. When the breadcrumb feature is enabled via blocks, widgets, shortcodes, or template tags on search results pages, the application fails to adequately sanitize or validate specific input values before passing them into the WordPress do_shortcode function. This lack of validation creates a direct pathway for code injection, bypassing standard security controls that typically restrict such operations to authenticated users with elevated privileges.
From an operational perspective, this vulnerability poses severe risks to website integrity and data confidentiality. Because the attack vector does not require authentication, any internet user can exploit it by crafting specific requests that trigger the execution of arbitrary shortcodes. This capability enables attackers to perform a wide range of malicious actions depending on what other plugins or themes are installed on the target site. Potential impacts include cross-site scripting attacks where malicious JavaScript is executed in the context of victims' browsers, leading to session hijacking or credential theft. Furthermore, if certain dangerous shortcodes are available within the environment, attackers could potentially achieve remote code execution, gain unauthorized access to administrative areas, or exfiltrate sensitive database information. The requirement that the breadcrumb feature be rendered on search results pages defines a specific condition for exploitation but does not significantly limit the attack surface given how commonly such features are utilized in modern WordPress themes and SEO configurations.
This vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), as well as CWE-77, involving Command Injection via external input that is improperly neutralized before being used in a command. In the context of the MITRE ATT&CK framework for enterprise security, this flaw facilitates techniques associated with Initial Access and Execution, specifically allowing attackers to leverage web application vulnerabilities to gain a foothold within the system. The ability to execute arbitrary code without authentication places it among high-severity issues that can lead to complete site compromise if left unpatched. Security professionals should note that while the vulnerability is specific to the AIOSEO plugin's breadcrumb functionality, its impact ripples through any WordPress installation where this feature is active and exposed on publicly accessible pages like search results.
To mitigate this risk, immediate action is required by website administrators using affected versions of The All in One SEO plugin. The primary remediation step is to upgrade the plugin to a version later than 5.0.2, where the developers have implemented proper input validation and sanitization mechanisms before invoking do_shortcode. Until an update can be applied, site owners should consider disabling the breadcrumb feature on search results pages if it is not strictly necessary for their SEO strategy. Additionally, implementing Web Application Firewalls with rulesets tuned to detect shortcode injection patterns can provide a layer of defense against exploitation attempts. Regular security audits and monitoring of server logs for unusual requests targeting WordPress endpoints are also recommended to identify potential probing or active exploitation efforts by malicious actors seeking to leverage this specific weakness in the AIOSEO codebase.