{
 "id": "WPSEC-2026-1653",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1653/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1653/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1653/index.md",
 "title": "ThinkRank AI SEO <= 2.17.1 - Unauthenticated Clickjacking via MCP OAuth Authorization Consent Page",
 "description": "The ThinkRank AI SEO plugin for WordPress is vulnerable to Clickjacking in all versions up to, and including, 2.17.1 due to the MCP OAuth authorization consent page and its error page being served without X-Frame-Options or a frame-ancestors Content-Security-Policy header. This makes it possible for unauthenticated attackers to frame the consent page and trick a logged-in administrator into approving an attacker-registered OAuth client, granting that client MCP access to the site. Exploitation requires the MCP feature to be enabled and a victim to interact with an attacker-controlled page.",
 "plugin": {
  "slug": "thinkrank",
  "name": "ThinkRank AI SEO",
  "full_name": "ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO",
  "wordpress_org": "https://wordpress.org/plugins/thinkrank/",
  "advisories_url": "https://wpsec.com/vuln/plugin/thinkrank/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/thinkrank"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-1021"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.2,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.18.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.18.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.18.0",
 "remediation": "Update to 2.18.0 or later.",
 "fix_released": "2026-10-25T06:46:25+00:00",
 "published": "2026-10-26T07:47:27+00:00",
 "updated": "2026-10-25T10:58:06.666520+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1653/",
  "https://plugins.svn.wordpress.org/thinkrank/tags/2.18.0/",
  "https://wordpress.org/plugins/thinkrank/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/thinkrank",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-26"
 }
}