# ThinkRank AI SEO <= 2.17.1 - Authenticated (Contributor+) Missing Authorization to AI Metadata Generation

- **ID:** WPSEC-2026-1655
- **Plugin:** ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO (`thinkrank`), https://wordpress.org/plugins/thinkrank/
- **Affected versions:** all versions before 2.18.0
- **Fixed in:** 2.18.0 (Update to 2.18.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-26)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/thinkrank
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1655/

## Description

The ThinkRank AI SEO plugin for WordPress is vulnerable to unauthorized use of AI features via the thinkrank_generate_post_metadata AJAX action in all versions up to, and including, 2.17.1. This is due to the handler checking only edit_post for the target post and not the plugin's AI Tools capability, while the nonce it requires is printed in the post editor for every user who can edit a post. This makes it possible for authenticated attackers with Contributor-level access and above to trigger AI metadata generation for their own posts using the site's configured AI provider and API key, spending the site owner's AI credits and bypassing the access restrictions configured in the plugin's Role Manager.

## References

- https://wpsec.com/vuln/WPSEC-2026-1655/
- https://plugins.svn.wordpress.org/thinkrank/tags/2.18.0/
- https://wordpress.org/plugins/thinkrank/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1655/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.