CVE-2026-9289: WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{itemid}, jsonld/post-meta/{metakey}, jsonld/meta/{metakey}, and jsonld/{posttype}/{postname}) with a permissioncallback of 'returntrue' and the downstream converter retrieving the post via getpost() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any unauthenticated remote attacker can exploit the affected JSON-LD REST API routes. No WordPress account, privileges, or user interaction is required.
What information could be exposed?
Attackers can enumerate post IDs to retrieve information from private, draft, and pending posts, including titles, content or descriptions, authors, publication and modification dates, word counts, comment counts, and other metadata.
Are non-public posts affected?
Yes. The affected routes retrieve posts without checking post status or the requester's capabilities, bypassing WordPress core access controls for private, draft, and pending posts.
Which installations are affected?
WordLift versions up to and including 3.54.10 are affected. The issue is present in the plugin's JSON-LD REST API routes.