CVE-2021-24307

What it actually does

CVE-2021-24307 is an authenticated PHP object deserialization vulnerability in the All in One SEO WordPress plugin before version 4.1.0.2. The plugin’s configuration restore feature accepts an uploaded backup .ini file and attempts to unserialize values from that file. An authenticated user with the aioseo_tools_settings capability can supply a malicious serialized payload. Because the plugin includes the Monolog PHP library, an attacker can use a gadget chain to trigger arbitrary system command execution on the underlying web server. Successful exploitation can provide remote code execution with the privileges of the PHP/web server process, enabling file modification, malware deployment, credential theft, or further lateral movement from the WordPress host.

Why it matters to the business

A successful attack can turn a WordPress site into an attacker-controlled server, allowing website defacement, data theft, malware hosting, SEO spam injection, credential harvesting, or disruption of business operations. Although exploitation requires an authenticated user with access to the plugin tools area, compromised administrator accounts, malicious insiders, or overly broad WordPress roles can make this practical. The EPSS score is high and public exploit techniques are available, so internet-facing WordPress sites running affected plugin versions should be treated as priority remediation targets even though this issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker first obtains access to a WordPress account that has the aioseo_tools_settings capability, which is commonly associated with administrator-level access. The attacker navigates to the All in One SEO tools import/export functionality and uploads a crafted backup .ini file. Instead of containing only benign configuration values, the file contains PHP serialized data designed to instantiate classes from the bundled Monolog library. When the plugin processes the import, it unserializes attacker-controlled content, causing the gadget chain to execute. The final payload can run operating system commands as the web server user, such as writing a PHP web shell, modifying WordPress files, creating persistence, downloading additional tools, or exfiltrating sensitive configuration files such as wp-config.php.

How to fix it

Upgrade All in One SEO to version 4.1.0.2 or later. If immediate upgrade is not possible, restrict access to the All in One SEO Tools Import/Export functionality to only highly trusted administrators, review and minimize users with the aioseo_tools_settings capability, disable the plugin temporarily where business impact permits, and block untrusted access to /wp-admin/ using MFA, IP allowlisting, or a web application firewall. Treat any affected site with suspicious imports or unexpected file changes as potentially compromised and perform incident response before returning it to service. Rotate WordPress administrator passwords, application secrets, hosting control panel credentials, and database credentials if exploitation is suspected.

How to confirm the fix worked

Confirm the installed All in One SEO plugin version is 4.1.0.2 or later. Validate through the WordPress admin plugin inventory, WP-CLI, or filesystem inspection of the plugin metadata under wp-content/plugins/all-in-one-seo-pack/. Confirm that only expected roles or users have the aioseo_tools_settings capability. Attempt to access the All in One SEO import/export tools as non-administrative users and verify access is denied. Review whether legacy plugin copies, backup directories, staging sites, or cloned WordPress installations still contain vulnerable versions. For internet-facing sites, verify that administrative access is protected by MFA, strong passwords, and restricted exposure where feasible.

Typical attack path

1. Acquire or compromise a WordPress account with aioseo_tools_settings capability, often an administrator account.
2. Access the WordPress admin dashboard over the network.
3. Open the All in One SEO Tools Import/Export feature.
4. Upload a malicious .ini backup file containing a crafted PHP serialized object payload.
5. Trigger unserialization during the plugin restore/import workflow.
6. Use a Monolog gadget chain to execute system commands through the PHP process.
7. Write or stage a web shell, modify plugin/theme files, create persistence, or execute follow-on commands.
8. Use the compromised WordPress host for data theft, spam injection, credential theft, or pivoting.

How to detect it

Review WordPress application logs, web server access logs, PHP error logs, WordPress security/audit plugin logs, file integrity monitoring alerts, and endpoint telemetry from the web host. Focus on authenticated admin activity involving the All in One SEO Tools Import/Export page, especially POST requests with multipart file uploads or .ini filenames. Look for PHP serialized object payloads in request bodies, uploaded temporary files, WAF logs, or retained access logs, especially strings referencing Monolog classes. Correlate suspicious import activity with new or modified PHP files in wp-content/uploads/, wp-content/plugins/, wp-content/themes/, and the WordPress document root. Check for unexpected child processes spawned by the web server or PHP runtime, such as sh, bash, curl, wget, nc, perl, python, or php executing command-line payloads. Investigate outbound network connections shortly after plugin import events. Because the exploit requires authentication, also review WordPress login history for unusual administrator logins, new admin users, role changes, capability changes, password resets, or logins from unfamiliar IP addresses. Threat hunting should include both web-shell artifacts and SEO-spam indicators, such as injected links, hidden content, unfamiliar redirects, or modified theme/plugin PHP files.

• /wp-admin/admin.php?page=aioseo-tools
• page=aioseo-tools
• aioseo_tools_settings
• multipart/form-data
• Content-Disposition: form-data
• filename="*.ini"
• O:32:"Monolog\\Handler\\SyslogUdpHandler"
• O:29:"Monolog\\Handler\\BufferHandler"
• O:30:"Monolog\\Handler\\StreamHandler"
• O:36:"Monolog\\Handler\\NativeMailerHandler"
• Monolog\\Handler
• wp-content/plugins/all-in-one-seo-pack/
• wp-content/uploads/*.php
• wp-content/uploads/*.phtml
• wp-content/uploads/*.phar
• wp-content/themes/*.php
• wp-content/plugins/*.php
• wp-config.php
• /bin/sh -c
• /bin/bash -c
• curl http
• wget http
• base64_decode(
• eval(
• shell_exec(
• system(
• passthru(
• assert(

What your security team should do

• Patch All in One SEO to version 4.1.0.2 or later across all WordPress installations, including staging and backup sites.
• Prioritize externally accessible WordPress sites because public exploitation techniques exist and EPSS likelihood is elevated.
• Audit WordPress administrator accounts and users with aioseo_tools_settings; remove unnecessary access immediately.
• Search web, PHP, and WordPress logs for suspicious All in One SEO import/export activity, especially POST requests uploading .ini files.
• Inspect wp-content/uploads/, plugin directories, theme directories, and the WordPress root for recently modified PHP files or web shells.
• If exploitation is suspected, preserve logs and filesystem evidence before cleanup, then rotate WordPress, database, hosting, FTP/SFTP, SSH, and API credentials.
• Deploy or tune WAF/SIEM detections for authenticated POST requests to the All in One SEO tools page with multipart uploads or serialized PHP object strings.
• Monitor for outbound connections from the web server to unfamiliar IPs or domains after suspicious import activity.