{"id":"CVE-2026-76780","aliases":[],"title":"BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation","titleSource":"Wordfence","descriptionSource":"Wordfence","products":[{"vendor":"rankingcoach","name":"BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.6","versionType":"semver"}],"defaultStatus":"unaffected","source":"Wordfence","url":"https://www.cve.org/CVERecord?id=CVE-2026-76780"}],"remediation":[],"description":"The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.","severity":"medium","score":6.3,"published":"2026-10-28T06:45:20.777Z","modified":"2026-10-28T06:45:20.777Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4b2396-288f-45e6-b911-b017dc8d0526?source=cve","https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleBase/BaseModule.php#L249","https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManager.php#L67","https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleBase/BaseSubmoduleApi.php#L289","https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManagerApi.php#L266","https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManagerHooks.php#L51","https://plugins.trac.wordpress.org/changeset?reponame=&old=3722492%40beyondseo&new=3722492%40beyondseo"],"sources":[{"name":"CVE","id":"CVE-2026-76780","modified":"2026-10-28T06:45:20.777Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-76780"}],"assessments":[{"source":"Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:40:31.555Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T09:25:32.527Z","attemptedAt":"2026-10-28T09:25:32.527Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T09:25:32.046Z","attemptedAt":"2026-10-28T09:25:32.046Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T09:25:32.160Z","attemptedAt":"2026-10-28T09:25:32.160Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T09:25:32.472Z","attemptedAt":"2026-10-28T09:25:32.472Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-111611","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111611","modified":"Oct 28, 2026, 6:45:20 AM","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","checkedAt":"2026-10-28T09:25:32.160Z"},{"source":"NVD","id":"CVE-2026-76780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76780","modified":"2026-10-28T07:16:49.060","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","checkedAt":"2026-10-28T09:25:32.527Z"}]}