The vulnerability in the All in One SEO plugin allows authenticated users with Contributor level or higher to permanently delete media files owned by other users. The REST API endpoint /wp-json/aioseo/v1/ai/image‑generator verifies only that the user can edit posts, neglecting any check for ownership or delete permission of the targeted media attachment. As a result, an attacker who can determine a valid attachment ID can cause irretrievable loss of media, compromising site integrity and potentially business assets.

WordPress sites running the All in One SEO Pack plugin version 4.8.9 or earlier are affected. The issue exists in every release up to 4.8.9, regardless of additional plugins or themes.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of <1% suggests that automated exploitation is unlikely, yet a determined insider or compromised contributor account could exploit the flaw manually. The vulnerability is not listed in the CISA KEV catalog. Attackers must authenticate and possess Contributor or higher capability, then supply a valid media attachment ID to the REST endpoint to delete it.