All In One SEO plugin flaws: a simple checklist for WordPress sites

What has been reported

Search Engine Journal reports that the All In One SEO plugin for WordPress, often called AIOSEO, has two medium-severity security flaws. The report says these flaws could let unauthenticated attackers compromise affected websites. That means an attacker would not need to log in first.

"Medium severity" matters here. These are not the most serious class of flaw. This is not a reason to panic. But it is a reason to act. Flaws that do not need a login are the kind that automated tools look for. So a site that sits unpatched for weeks is an easier target than one that was updated promptly.

The plugin maker has released a fix, and that is how the system is meant to work. Flaws are found and reported, then patched. The weak point is usually the gap between a fix being released and a site owner installing it.

Why this matters to UK small businesses

WordPress is widely used by UK small businesses. Many of them add an SEO plugin to manage page titles, descriptions and sitemaps. All In One SEO is one of the well-known choices. So this story is likely to touch a lot of local firms, shops and service businesses, even if they have never heard of it.

Many small business websites were built once and then left to run. The person who set the site up may have moved on. Plugins can pile up over the years, and some may no longer be needed. Admin logins get shared with staff, freelancers and agencies, and are rarely tidied away. None of this is unusual. But each of these habits makes a site a little harder to keep safe.

The good news is that the fix is simple and costs little more than half an hour of attention. A short, regular routine covers most of the risk from this story and from the next one like it.

What this means for UK businesses

• Update All In One SEO now. Install the patched version from your WordPress dashboard. If you do not manage your own site, ask whoever does to confirm it has been done.
• Remove what you do not use. Every plugin is extra code that needs looking after. If a plugin is switched off or no longer needed, delete it rather than leaving it in place.
• Check backups and access. Make sure you have a recent backup stored away from your website. Then review who has admin logins and remove anyone who no longer needs them.
• Make it a routine. A short monthly check is far easier than fixing a compromised site.

Analysis compiled by Sayu (sayu.co.uk), a UK digital marketing agency.