The vulnerability identified as CVE-2025-64295 affects the All In One SEO Pack plugin by Syed Balkhi, allowing an attacker with some privileges to cause sensitive information to be inserted into data sent by the plugin. This could lead to unauthorized disclosure of sensitive data. The issue impacts all versions up to 4.8.6.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

Successful exploitation could result in unauthorized disclosure of sensitive information embedded in the data sent by the plugin. There is no indication of impact on data integrity or availability. The vulnerability requires some level of privileges, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to accounts with privileges that could exploit this vulnerability and monitor for suspicious activity related to data exposure in the plugin. Avoid exposing sensitive data unnecessarily within the plugin's configuration or output.