CVE-2026-5075 — The All in One SEO plugin for WordPress is vulnerable to

title: WordPress All in One SEO Plugin Sensitive Data Exposure — CVE-2026-5075
id: scw-2026-05-20-ai-1
status: experimental
level: medium
description: |
  Detects requests to the WordPress AJAX endpoint that are likely attempting to exfiltrate sensitive internal option data, such as API/OAuth tokens and license keys, from the All in One SEO plugin. This is specific to CVE-2026-5075 where low-privilege users can access this data.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-5075/
tags:
  - attack.discovery
  - attack.t1005
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=aioseo_get_options'
      sc-status:
          - 200
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse