cyfenced.com →

[ CVE-2026-76780 · Published 28 Oct 2026 ]

Vulnerability in rankingcoach BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility

CVSS 6.3 EPSS <1%No fix listed yet

[ Description ]Official description

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References