ThinkRank AI SEO <= 2.14.2 - Unauthenticated Sensitive Information Exposure of Password-Protected Post Content via SEO Meta Tags
- ID
- WPSEC-2026-0780
- Plugin
- ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO (thinkrank)
- Affected
- all versions before 2.14.3
- Remediation
- Update to 2.14.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-12
- Attack surface
- ThinkRank AI SEO on WPSec AttackSurface
- Fix released
- Published
Description
The ThinkRank AI SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via the %excerpt% variable in per-post SEO fields in all versions up to, and including, 2.14.2. This is due to Pattern_Resolver::placeholders_for() deriving %excerpt% from the post body even when the post is password protected and has no manual excerpt. This makes it possible for unauthenticated attackers to read part of the protected content in the SEO title, meta description, Open Graph/Twitter tags and JSON-LD printed on the password prompt page, when a per-post SEO field of that post uses the %excerpt% variable.
References
- https://wpsec.com/vuln/WPSEC-2026-0780/
- https://plugins.svn.wordpress.org/thinkrank/tags/2.14.3/
- https://wordpress.org/plugins/thinkrank/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS