CVE-2026-76780 json
BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation
published 2026-10-28 12 d ago modified 2026-10-29 11 d ago also EUVD-2026-111611
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 11 d ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected products
- rankingcoach BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/dd4b2396-288f-45e6-b911-b017dc8d0526?source=cve
- plugins.trac.wordpress.org /browser/beyondseo/tags/1.3.1/inc/Modules/ModuleBase/BaseModule.php#L249
- plugins.trac.wordpress.org /browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManager.php#L67
- plugins.trac.wordpress.org /browser/beyondseo/tags/1.3.1/inc/Modules/ModuleBase/BaseSubmoduleApi.php#L289
- plugins.trac.wordpress.org /browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManagerApi.php#L266
- plugins.trac.wordpress.org /browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManagerHooks.php#L51
- plugins.trac.wordpress.org /changeset?reponame=&old=3722492%40beyondseo&new=3722492%40beyondseo
Sources
- CVE List CVE-2026-76780
- NVD CVE-2026-76780
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.