The vulnerability identified as CVE-2025-58650 affects the All In One SEO Pack plugin by Syed Balkhi. It is caused by missing authorization checks, allowing users with some privileges to perform actions beyond their intended access level. The issue impacts versions up to and including 4.8.7.1. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. There is no indication of an official patch or vendor advisory at this time.

An attacker with limited privileges can exploit this missing authorization vulnerability to perform unauthorized actions that may affect the integrity and availability of the affected system. Confidentiality is not impacted. The medium severity score reflects these limited but meaningful impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's administrative functions to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.