{
 "id": "WPSEC-2026-1655",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1655/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1655/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1655/index.md",
 "title": "ThinkRank AI SEO <= 2.17.1 - Authenticated (Contributor+) Missing Authorization to AI Metadata Generation",
 "description": "The ThinkRank AI SEO plugin for WordPress is vulnerable to unauthorized use of AI features via the thinkrank_generate_post_metadata AJAX action in all versions up to, and including, 2.17.1. This is due to the handler checking only edit_post for the target post and not the plugin's AI Tools capability, while the nonce it requires is printed in the post editor for every user who can edit a post. This makes it possible for authenticated attackers with Contributor-level access and above to trigger AI metadata generation for their own posts using the site's configured AI provider and API key, spending the site owner's AI credits and bypassing the access restrictions configured in the plugin's Role Manager.",
 "plugin": {
  "slug": "thinkrank",
  "name": "ThinkRank AI SEO",
  "full_name": "ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO",
  "wordpress_org": "https://wordpress.org/plugins/thinkrank/",
  "advisories_url": "https://wpsec.com/vuln/plugin/thinkrank/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/thinkrank"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.18.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.18.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.18.0",
 "remediation": "Update to 2.18.0 or later.",
 "fix_released": "2026-10-25T06:46:25+00:00",
 "published": "2026-10-26T07:47:27+00:00",
 "updated": "2026-10-25T10:58:06.666520+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1655/",
  "https://plugins.svn.wordpress.org/thinkrank/tags/2.18.0/",
  "https://wordpress.org/plugins/thinkrank/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/thinkrank",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-26"
 }
}