Description
The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.
References7
- plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Mod…
- plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Mod…
- plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Mod…
- plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Mod…
- plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Mod…
- plugins.trac.wordpress.org/changeset?reponame=&old=3722492%40be…
- www.wordfence.com/threat-intel/vulnerabilities/id/dd4b2396-288f…
Metrics
- CVSS 3.1
-
6.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - EPSS — exploit probability
- 0% percentile: 11 · as of 3 November 2026
- CWE
- CWE-269
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.