Praison Ai Seo
Monthly
Broken access control in the Praison AI SEO WordPress plugin before 5.0.7 lets unauthenticated attackers reach several REST API routes that lack authorization checks, allowing them to alter the permalink of any published post and to read the plugin's stored configuration data. WPScan reported the issue and publicly available exploit code exists, though EPSS remains low at 0.19% and it is not on CISA KEV. Exposure of configuration data (potentially including AI-service API keys and SEO settings) plus silent permalink tampering can break site links and SEO ranking with no login required.
Broken access control in the Praison AI SEO WordPress plugin before 5.0.7 lets unauthenticated attackers reach several REST API routes that lack authorization checks, allowing them to alter the permalink of any published post and to read the plugin's stored configuration data. WPScan reported the issue and publicly available exploit code exists, though EPSS remains low at 0.19% and it is not on CISA KEV. Exposure of configuration data (potentially including AI-service API keys and SEO settings) plus silent permalink tampering can break site links and SEO ranking with no login required.