Older versions of the popular WordPress plugin All in One SEO contain a vulnerability that allows an attacker to store malicious code in the admin panel that could potentially help them take over the website.
This particular plugin (All in One SEO) helps page administrators improve SEO (Search Engine Optimization) with many settings.
One of these settings is called Bot Blocker and it allows administrators to decide which search engines are allowed to access their site. This setting is disabled by default, so there is no need to worry for plugin users.
If someone now uses this feature, according to security researcher David Vaartjes, the plugin records these bot visits, without cleaning up the text present in the User Agent.
So if an attacker can change these attributes by appending malicious code, (if of course they know which bot is blocked on the site) then the attack is successful.
Although many parameters must coincide for the attack to be successful, don't wait, upgrade to the next version..
