ThinkRank AI SEO <= 2.14.2 - Authenticated (Contributor+) Missing Authorization to Restricted ThinkRank REST Endpoints via Mixed-Case Route
- ID
- WPSEC-2026-0781
- Plugin
- ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO (thinkrank)
- Affected
- from 1.12.0 before 2.14.3
- Remediation
- Update to 2.14.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-178
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-12
- Attack surface
- ThinkRank AI SEO on WPSec AttackSurface
- Fix released
- Published
Description
The ThinkRank AI SEO plugin for WordPress is vulnerable to Missing Authorization via mixed-case REST routes in all versions up to, and including, 2.14.2. This is due to the Role Manager REST gate (Role_Manager::gate_rest) and Capability_Manager::capability_for_route() comparing the raw request route against lowercase '/thinkrank/v1/' and '/thinkrank-pro/v1/' prefixes and section keys, while the WordPress REST server matches routes case-insensitively. A request to /ThinkRank/v1/... skips the gate entirely, including the base ThinkRank access check, and a mixed-case section name falls back to the base access capability. This makes it possible for authenticated attackers with Contributor-level access and above, who have not been granted ThinkRank access, to reach endpoints whose own permission check only requires edit_posts. They can run the site's AI generation features using its configured AI provider and read ThinkRank section settings, such as Global SEO, sitemap, social media and robots settings.
References
- https://wpsec.com/vuln/WPSEC-2026-0781/
- https://plugins.svn.wordpress.org/thinkrank/tags/2.14.3/
- https://wordpress.org/plugins/thinkrank/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS