AllAble Connector
AllAble Connector has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for AllAble Connector has a vendor fix available, so running the current release closes it.
All of these findings were reported by Ananda Dhakal. The current release is tested up to WordPress 7.1.3.
CVE-2026-97243AllAble Connector <= 0.13.4 - Missing Authorization
Read the full analysisVulnerability Records

AllAble Connector
Author
flexyma
AllAble is a Marketing AI Workspace — an AI agent that researches keywords against live data, writes SEO-optimised content, generates on-brand images, and publishes directly to your real marketing accounts. WordPress is one of the channels it connects to. AllAble Connector is the official plugin that links your WordPress site to AllAble. Once connected, the AllAble agent can manage complex content workflows on your site — publishing posts, updating SEO, handling WooCommerce products — all from a single conversation in your AllAble workspace. What AllAble can do on your WordPress site Write and publish SEO-optimised posts and pages, backed by real keyword research Update SEO titles, meta descriptions, and focus keywords across Rank Math, SEOPress, or Yoast Manage WooCommerce products, orders, and customers Manage The Events Calendar events, venues, and organizers Publish multilingual content across multiple languages and markets You stay in control AllAble gives you two modes. In ASK mode the agent proposes what it is about to do and waits for your approval before making any changes. In EXECUTE mode it works autonomously and delivers the finished result. You choose how much you hand off — and you can disconnect at any time. Supported WordPress plugins SEO: Rank Math, SEOPress, Yoast SEO E-commerce: WooCommerce (HPOS-compatible) Events: The Events Calendar WooCommerce and Events Calendar features are opt-in — enable the ones you want from the Abilities tab after connecting. How to connect Install and activate the plugin. Open AllAble in your WordPress admin menu. Click Connect to AllAble and follow the prompt. No API keys to copy, no config files to edit. The plugin sets up a secure connection automatically. A dedicated AllAble admin page shows the connection status and lets you disconnect with one click at any time. Important: back up your site and use with caution Because AllAble can create, update, and delete content on your site, please use it with care. Always keep a current backup of your site and database before making changes — most hosting providers offer automated backups, or you can use a dedicated backup plugin. AI tools can make mistakes, and a backup is your safety net if something does not go as expected. We are not responsible for any data loss or unintended changes resulting from the use of this plugin. Privacy AllAble only accesses your site when you ask it to. Nothing is sent in the background — no tracking, no analytics. AllAble Connector is developed and maintained by Flexyma. External services This plugin connects to the AllAble platform (operated by Flexyma). It is the official connector for that platform, so connecting your site to AllAble is the plugin’s core purpose. The service it contacts is described below, including what data is sent and when. AllAble platform (www.allable.ai / studio.allable.ai) When you click Connect to AllAble, the plugin sends your browser to https://studio.allable.ai/plugins/wp/connect-from-wp to authorise the connection. Connecting creates a dedicated WordPress Application Password for AllAble. After that, your AllAble workspace makes authenticated requests to your site’s REST API to read and write the data you ask it to manage (for example post and page content, SEO metadata, and site information). Data leaves your site to AllAble only in response to such an authenticated, user-initiated request — nothing is sent in the background. This service is required for the plugin to function. By connecting you agree to AllAble’s terms and privacy/GDPR policy: Terms of Service: https://www.allable.ai/terms-of-service/ Privacy & GDPR policy: https://www.allable.ai/gdpr/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C