The All in One SEO plugin for WordPress contains a flaw that allows authenticated users with contributor level or higher to view sensitive internal data. When a post‑editor page loads, the plugin passes its internalOptions to wp_localize_script without masking. This exposes API/OAuth tokens and license values directly in page source. The result is a confidentiality breach, enabling an attacker to obtain credentials that could be used to access external services or to compromise the site further. The weakness is classified as CWE-200.

WordPress installations that include the All in One SEO plugin version 4.9.7 or earlier are affected. The issue surfaces only in environments where the post editor is used, so sites that host content editors and have contributors or higher permission roles are at risk. Administrators should check for any installed version of the plugin that matches or is older than 4.9.7.

The CVSS score is 4.3, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV. The attack requires authenticated access with contributor rights or higher, so privilege escalation is not necessary. However, once logged in, an attacker can simply view the page source to harvest exposed tokens. Given the broad user base of WordPress and the many sites that still run older versions, the exposure poses a notable risk to confidentiality, but the exploitability is limited to trusted users of the site.