Cloudanix VulnDB

CVE-2025-12847

Medium · 4.3

CVSS

4.3

EPSS

0.3%

Published

Nov 15, 2025

CISA due date

—

The record

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `/wp-json/aioseo/v1/ai/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities