EUVD-2026-47884
GHSA-mr6p-pxvc-7864
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network REST access (AV:N/AC:L/PR:N/UI:N); config disclosure that may include secrets justifies C:H, and permalink tampering is a limited integrity impact (I:L), no availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.
AnalysisAI
Broken access control in the Praison AI SEO WordPress plugin before 5.0.7 lets unauthenticated attackers reach several REST API routes that lack authorization checks, allowing them to alter the permalink of any published post and to read the plugin's stored configuration data. WPScan reported the issue and publicly available exploit code exists, though EPSS remains low at 0.19% and it is not on CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires only that a WordPress site runs the Praison AI SEO plugin at a version below 5.0.7 with its REST API reachable over the network - the default state for an installed plugin, since WordPress exposes /wp-json/ routes by design. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and should temper the 7.5 CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends anonymous HTTP requests directly to the plugin's unprotected REST API routes, reading back the plugin's configuration data (potentially including stored keys or SEO settings) and issuing a follow-up request to rewrite the permalink of a targeted published post. This requires no authentication, no user interaction, and only low attack complexity; public exploit code from WPScan lowers the bar further. |
| Remediation | Vendor-released patch: 5.0.7 - update the Praison AI SEO plugin to version 5.0.7 or later, which is the primary and complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress instances using Praison AI SEO plugin and document current versions via plugin management systems or WP-CLI scanning. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today