# ThinkRank AI SEO <= 2.14.2 - Unauthenticated Sensitive Information Exposure of Password-Protected Post Content via SEO Meta Tags

- **ID:** WPSEC-2026-0780
- **Plugin:** ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO (`thinkrank`), https://wordpress.org/plugins/thinkrank/
- **Affected versions:** all versions before 2.14.3
- **Fixed in:** 2.14.3 (Update to 2.14.3 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/thinkrank
- **Fix released:** 2026-10-11
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0780/

## Description

The ThinkRank AI SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via the %excerpt% variable in per-post SEO fields in all versions up to, and including, 2.14.2. This is due to Pattern_Resolver::placeholders_for() deriving %excerpt% from the post body even when the post is password protected and has no manual excerpt. This makes it possible for unauthenticated attackers to read part of the protected content in the SEO title, meta description, Open Graph/Twitter tags and JSON-LD printed on the password prompt page, when a per-post SEO field of that post uses the %excerpt% variable.

## References

- https://wpsec.com/vuln/WPSEC-2026-0780/
- https://plugins.svn.wordpress.org/thinkrank/tags/2.14.3/
- https://wordpress.org/plugins/thinkrank/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0780/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.