BeyondSEO CVE-2026-76780

Exploitation requires an authenticated account at Contributor level or above on a site running Beyondseo ≤1.3.6, because defineCapabilities() grants the rankingcoach_write_* module capabilities (including rankingcoach_write_redirectManager) to the 'contributor' role by default, and the REST create/edit/delete callbacks (registered via BaseSubmoduleApi::registerRouteCreate/Edit/Delete) authorize only through checkPermissionsPost() calling current_user_can('rankingcoach_write_<module>') with no admin-capability, ownership, or in-callback nonce check. The limiting factor is the Contributor foothold: on sites that do not permit untrusted user registration at Contributor level or higher, the realistic attack surface is small. No special non-default plugin configuration is required - the over-grant is in the plugin's default capability list - and the Redirect Manager module must be active so RedirectManagerHooks::handleRedirects() executes the injected redirects on template_redirect.

This is a genuine but moderate-priority issue, not an emergency. The CVSS 6.3 (Medium) vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L is internally consistent with the description: network-reachable REST endpoints, low attack complexity, and a required low-privilege (Contributor) account - so PR:L (authenticated) is confirmed by the vector. The core weakness (CWE-269) is that BaseModule::defineCapabilities() permanently grants rankingcoach_write_* capabilities to the Contributor role, and the REST create/edit/delete callbacks authorize solely via current_user_can('rankingcoach_write_<module>') with no admin, ownership, or nonce re-check, letting a Contributor act as an administrator over site-wide redirects. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a Medium score. No EPSS score, no CISA KEV listing, and no confirmed working exploit are present in the input, so there is no signal of active or widespread exploitation; the real-world risk is gated by the requirement that an attacker first hold a Contributor-or-above account, which limits it to sites that allow untrusted contributor registration. Net: patch on a normal maintenance cadence; prioritize sites with open contributor/author registration since there the barrier is low.

An attacker registers or obtains a Contributor-level account on a WordPress site running Beyondseo ≤1.3.6, then sends authenticated requests to the plugin's redirect-manager REST endpoints (create/edit/delete) that only check the over-granted 'rankingcoach_write_redirectManager' capability. They create a 301/302 redirect that RedirectManagerHooks::handleRedirects() applies to every frontend visitor on template_redirect, hijacking paths such as /checkout or /wp-login to an attacker-controlled destination for phishing or traffic theft. No public exploit code is identified in the sources; exploitation is low-complexity but requires the Contributor foothold.