CVE-2026-76780: BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation
The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoachwriteredirectManager' (and sibling rankingcoachwrite module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls currentusercan('rankingcoachwrite<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on templateredirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The affected plugin grants Contributors the relevant rankingcoach_write_* capabilities.
What can an attacker do after exploiting it?
They can create, modify, or delete site-wide 301/302 redirects through the plugin's REST endpoints. Because redirects are applied to frontend visitors, an attacker can hijack arbitrary paths, including paths such as /checkout or /wp-login.
Are default Contributor accounts affected?
Yes. The plugin's default role list for these module capabilities includes the Contributor role, so Contributor-level accounts receive the capability used by the affected endpoints.
What authorization checks do the affected REST endpoints perform?
State-changing requests are authorized only by checking whether the current user has the relevant rankingcoach_write_<module> capability. The described checks do not require an administrator capability, resource ownership verification, or an additional nonce check in the callback.