The All in One SEO (AIOSEO) plugin for WordPress has recently been found to have two critical vulnerabilities that could put website owners at risk. The first vulnerability, identified as CVE-2021-35524, allows attackers to execute an SQL injection attack that can lead to data theft, modification, or deletion. This vulnerability is caused by the lack of input sanitization in the plugin’s CSV data export function.
The second vulnerability, identified as CVE-2021-35525, allows attackers to execute arbitrary code by exploiting a deserialization vulnerability in the plugin’s administrative backend. Attackers can exploit this vulnerability by sending a specially crafted request to the targeted website’s server.
Wordfence, a WordPress security company, discovered both vulnerabilities and alerted the AIOSEO team. The team has since released a patch for both vulnerabilities in version 4.1.0 of the plugin. It’s essential for website owners to update their plugin to the latest version as soon as possible.
To minimize the risk of such vulnerabilities being exploited, website owners are advised to take steps such as installing security plugins, keeping their plugins and WordPress installations up to date, and regularly backing up their website data. These measures can help prevent attackers from gaining control of a website, stealing sensitive data, or damaging the website’s reputation.
It’s crucial to address plugin vulnerabilities as they can pose a significant threat to website security. Website owners should remain vigilant about plugin updates, patch releases, and security best practices to ensure their website remains secure.
