Wordlift Ai Powered Seo Schema
Monthly
Unauthenticated information disclosure in the WordLift - AI powered SEO - Schema plugin for WordPress affects all versions up to and including 3.54.10, allowing remote attackers with no credentials to harvest the title, body content, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts. The flaw stems from the plugin's /wordlift/v1/jsonld/ REST routes being registered with a permission_callback of '__return_true', combined with a downstream JSON-LD converter that calls get_post() without validating post status or the caller's capabilities, so sequential post-ID enumeration bypasses WordPress core access controls. No public exploit code was identified at time of analysis and the vulnerability is not reported as actively exploited; the CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only, low-complexity disclosure with no integrity or availability impact.
Unauthenticated information disclosure in the WordLift - AI powered SEO - Schema plugin for WordPress affects all versions up to and including 3.54.10, allowing remote attackers with no credentials to harvest the title, body content, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts. The flaw stems from the plugin's /wordlift/v1/jsonld/ REST routes being registered with a permission_callback of '__return_true', combined with a downstream JSON-LD converter that calls get_post() without validating post status or the caller's capabilities, so sequential post-ID enumeration bypasses WordPress core access controls. No public exploit code was identified at time of analysis and the vulnerability is not reported as actively exploited; the CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only, low-complexity disclosure with no integrity or availability impact.