ThinkRank AI SEO <= 2.17.1 - Authenticated (Contributor+) Missing Authorization to AI Metadata Generation
- ID
- WPSEC-2026-1655
- Plugin
- ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO (thinkrank)
- Affected
- all versions before 2.18.0
- Remediation
- Update to 2.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-26
- Attack surface
- ThinkRank AI SEO on WPSec AttackSurface
- Fix released
- Published
Description
The ThinkRank AI SEO plugin for WordPress is vulnerable to unauthorized use of AI features via the thinkrank_generate_post_metadata AJAX action in all versions up to, and including, 2.17.1. This is due to the handler checking only edit_post for the target post and not the plugin's AI Tools capability, while the nonce it requires is printed in the post editor for every user who can edit a post. This makes it possible for authenticated attackers with Contributor-level access and above to trigger AI metadata generation for their own posts using the site's configured AI provider and API key, spending the site owner's AI credits and bypassing the access restrictions configured in the plugin's Role Manager.
References
- https://wpsec.com/vuln/WPSEC-2026-1655/
- https://plugins.svn.wordpress.org/thinkrank/tags/2.18.0/
- https://wordpress.org/plugins/thinkrank/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS