CVE-2026-76780

Full vulnerability record from the local CVENow database.

Description

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.

Severity

MEDIUM

CVSS score

6.3 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-10-28 07:16:49.060000

Last modified

2026-10-29 02:16:53.563000

View original CVE JSON

{
  "id": "CVE-2026-76780",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-28T07:16:49.060",
  "lastModified": "2026-10-29T02:16:53.563",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "rankingcoach",
          "product": "BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.3.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-29T01:29:55.814453Z",
          "id": "CVE-2026-76780",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleBase/BaseModule.php#L249",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleBase/BaseSubmoduleApi.php#L289",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManager.php#L67",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManagerApi.php#L266",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManagerHooks.php#L51",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3722492%40beyondseo&new=3722492%40beyondseo",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4b2396-288f-45e6-b911-b017dc8d0526?source=cve",
      "source": "[email protected]"
    }
  ]
}