BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility に脆弱性 — CVE-2026-76780

いま何をすべきか

BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility を 1.3.7 以降に更新してください。

影響を受けるバージョン

• 1.3.6 以下のすべて

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.

この説明は公開データベースの記載をそのまま載せています。 日本語の要約は付けていません。訳の過程で意味が変わると、対応の判断を誤らせるためです。

• https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4b2396-288f-45e6-b911-b017dc8d0526?source=api-prod

この情報の一部は Wordfence Intelligence から取得しています。 原本: https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4b2396-288f-45e6-b911-b017dc8d0526
Copyright 2012-2026 Defiant Inc. ／ ライセンス全文

掲載内容は公開データベースを自動集計したものです。 正確性を保証するものではありません。対応にあたっては開発元の公式情報をご確認ください。