CVE-2025-12847

A vulnerability exists in the All in One SEO plugin for WordPress, affecting versions up to 4.8.9. The issue lies in the plugin's REST API endpoint, which allows users with Contributor-level access or higher to delete arbitrary media attachments, even if they don't own or have permission to delete those specific files. This is because the endpoint only checks for the 'edit_posts' capability, not ownership or deletion permissions. As a result, an authenticated attacker with sufficient access can delete any media attachment by its ID.

Based on public CVE data (MITRE/NVD).