EUVD-2026-47884
GHSA-mr6p-pxvc-7864
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover WordPress site running Praison AI SEO
-
DeliverySend unauthenticated REST API request
-
ExploitBypass missing authorization check
-
ExecutionRead plugin configuration data
-
PersistRewrite permalink of published post
-
ImpactDegrade SEO and expose secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that a WordPress site runs the Praison AI SEO plugin at a version below 5.0.7 with its REST API reachable over the network - the default state for an installed plugin, since WordPress exposes /wp-json/ routes by design. No authentication, credentials, or user interaction are needed (PR:N/UI:N confirmed by CVSS). What limits exploitation is deployment scale rather than technical prerequisites: the plugin is niche, so the population of vulnerable sites is small, and impact is bounded to reading plugin configuration data and changing post permalinks - not full site takeover. Sites that block anonymous access to /wp-json/ via a WAF or auth layer are not exploitable through this path. |
| Impact | Signals are mixed and should temper the 7.5 CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes trivial remote, unauthenticated, low-complexity access with high confidentiality impact and no integrity impact - yet the description explicitly says attackers can MODIFY permalinks, which is an integrity effect the vector does not capture (I:N appears understated; verify with vendor/WPScan). EPSS is low (0.19%, 8th percentile) and there is no CISA KEV listing, indicating no evidence of widespread automated exploitation despite publicly available exploit code from WPScan. The realistic priority is moderate: exploitation is easy and unauthenticated, but the affected plugin appears niche, limiting mass-exploitation appeal. Config-data disclosure is the more serious impact if the plugin stores AI-provider API keys or secrets; the permalink change is more of a nuisance/SEO-integrity issue. Treat as an important patch-soon item on affected sites rather than an emergency, absent evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker sends anonymous HTTP requests directly to the plugin's unprotected REST API routes, reading back the plugin's configuration data (potentially including stored keys or SEO settings) and issuing a follow-up request to rewrite the permalink of a targeted published post. This requires no authentication, no user interaction, and only low attack complexity; public exploit code from WPScan lowers the bar further. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Broken access control in the Praison AI SEO WordPress plugin before 5.0.7 lets unauthenticated attackers reach several REST API routes that lack authorization checks, allowing them to alter the permalink of any published post and to read the plugin's stored configuration data. WPScan reported the issue and publicly available exploit code exists, though EPSS remains low at 0.19% and it is not on CISA KEV. Exposure of configuration data (potentially including AI-service API keys and SEO settings) plus silent permalink tampering can break site links and SEO ranking with no login required.
RemediationAI
Vendor-released patch: 5.0.7 - update the Praison AI SEO plugin to version 5.0.7 or later, which is the primary and complete fix. Consult the WPScan advisory (https://wpscan.com/vulnerability/d23cb7bd-b40c-4f87-a134-7c3b62043f18/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-12082) for details. If immediate patching is not possible, restrict access to the plugin's REST API routes at the web server or WAF layer (for example, block or authenticate unauthenticated requests to the plugin's /wp-json/ endpoints), or deactivate the plugin entirely until it can be updated - deactivation removes all SEO functionality the plugin provides and is the safest interim step. Because configuration data may be exposed, rotate any API keys or secrets stored in the plugin's settings after upgrading, since a pre-patch read may already have leaked them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin (Praison AI SEO) built on the WordPress REST API, which registers custom routes under /wp-json/. The root cause is CWE-862 (Missing Authorization): the plugin registers REST routes without a proper permission_callback (or with one that returns true), so WordPress never verifies the caller's capability before executing the handler. As a result, endpoints intended for privileged SEO management are reachable by anonymous requests. The affected CPE is cpe:2.3:a:unknown:praison_ai_seo covering all versions prior to 5.0.7. Because the flaw is at the authorization layer rather than in input parsing, no memory-safety or injection primitive is required - the attacker simply calls the exposed route directly.
Know when Praison Ai Seo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network REST access (AV:N/AC:L/PR:N/UI:N); config disclosure that may include secrets justifies C:H, and permalink tampering is a limited integrity impact (I:L), no availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.
Executive ViewAI
Praison AI SEO WordPress plugin versions before 5.0.7 contain broken access control allowing unauthenticated attackers to access protected REST API routes. Threat actors can read plugin configuration (including AI service API keys) and alter post permalinks without authentication, creating dual impact: credential compromise and silent SEO ranking damage affecting any organization running this plugin.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB