Beyondseo Ai Seo To Improve Rankings Listings Online Visibility
Monthly
Privilege escalation in the BeyondSEO WordPress plugin through version 1.3.6 allows authenticated users with Contributor-level access or above to create, update and delete site-wide 301/302 redirects, giving them administrator-equivalent control over redirect management and the ability to hijack arbitrary paths such as /checkout or /wp-login. The plugin permanently assigns its rankingcoach_write_* module capabilities to the Contributor role by default, and its REST create/edit/delete callbacks authorize only on that capability, so no administrator rights are needed beyond the Contributor foothold. No public exploit identified at time of analysis and no CISA KEV entry; the issue is a genuine but moderate-priority concern (this_month) rather than an emergency, because the realistic attack surface depends on sites that allow untrusted users to obtain Contributor-level accounts.
Privilege escalation in the BeyondSEO WordPress plugin through version 1.3.6 allows authenticated users with Contributor-level access or above to create, update and delete site-wide 301/302 redirects, giving them administrator-equivalent control over redirect management and the ability to hijack arbitrary paths such as /checkout or /wp-login. The plugin permanently assigns its rankingcoach_write_* module capabilities to the Contributor role by default, and its REST create/edit/delete callbacks authorize only on that capability, so no administrator rights are needed beyond the Contributor foothold. No public exploit identified at time of analysis and no CISA KEV entry; the issue is a genuine but moderate-priority concern (this_month) rather than an emergency, because the realistic attack surface depends on sites that allow untrusted users to obtain Contributor-level accounts.