# CVE-2026-5075: All in One SEO sensitive information exposure in internalOptions

Source: https://junglewise.ai/threats/cve-2026-5075-all-in-one-seo-sensitive-information-exposure-in-internaloptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-5075 · Severity: medium · CVSS 4.3 · Published 2026-05-20

The All in One SEO plugin for WordPress, which helps websites optimize their content for search engines, contains a security flaw that exposes sensitive internal data. This vulnerability allows users with low-level access, such as contributors, to view private information like API keys, OAuth tokens, and license details. An attacker could use this information to gain unauthorized access to connected services or compromise the site's SEO management tools.

Technologies: [All in One SEO](https://junglewise.ai/threats/technologies/all-in-one-seo). Vendors: [All in One SEO](https://junglewise.ai/threats/vendors/all-in-one-seo).

## Quick answers

**Is CVE-2026-5075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5075 being exploited in the wild.

**How severe is CVE-2026-5075?** Medium severity, with a CVSS score of 4.3, published 20 May 2026.

**Which products and versions are affected?** All in One SEO up to, and including, 4.9.7.

**Is there a fix for CVE-2026-5075?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5075 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5075?** Check whether you run All in One SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as an Exposure of Sensitive Information (CWE-200) within the All in One SEO plugin for WordPress. It stems from the 'internalOptions' localized script data being passed to the WordPress wp_localize_script() function in post editor contexts without proper masking or privilege checks. Authenticated attackers with at least contributor-level permissions can access the post editor and view the page source to retrieve sensitive internal configuration data, including API/OAuth tokens and license-related values. The issue is present in versions up to 4.9.7 and has been addressed in subsequent updates.

## Affected products

- All in One SEO All in One SEO up to, and including, 4.9.7

## Timeline

- 2026-05-20: disclosed: NVD publication date
- 2026-05-20: advisory: Wordfence advisory published

## References

- [https://plugins.trac.wordpress.org/changeset/3532318/all-in-one-seo-pack](https://plugins.trac.wordpress.org/changeset/3532318/all-in-one-seo-pack)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8bc203-c17a-4b31-8f9e-695f9e638cda?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8bc203-c17a-4b31-8f9e-695f9e638cda?source=cve)

## Related threats

- [All in One SEO WordPress plugin Stored XSS via AI Assistant Block](https://junglewise.ai/threats/cve-2026-82884-all-in-one-seo-wordpress-plugin-stored-xss-via-ai-assistant-block)