An SQL injection flaw exists in the All In One SEO Pack plugin developed by Syed Balkhi. The vulnerability allows an attacker to embed malicious SQL commands that are executed by the WordPress database engine, enabling the attacker to read, modify, or delete data stored in the WordPress database. This can compromise the confidentiality, integrity, or availability of site content or configuration. The weakness is classified as CWE‑89, Improper Neutralization of Special Elements used in an SQL Command.

WordPress sites running the All In One SEO Pack plugin version 4.9.1 or earlier are at risk. The affected package is identified as Syed Balkhi:All In One SEO Pack. Any instance of the plugin with a version number 4.9.1 or lower is considered vulnerable.

The CVSS score is 8.5, indicating high severity. The EPSS score is less than 1%, suggesting that the likelihood of an active exploitation at scale is low but not negligible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web-based, exploiting the plugin’s handling of user input through HTTP requests. Successful exploitation would provide an attacker with blind read or modify capabilities against the WordPress database, potentially leading to full compromise of the installation.