ThinkRank AI SEO <= 2.18.1 - Authenticated (Subscriber+) Privilege Escalation via ThinkRank Capabilities Granted to Roles Without edit_posts
- ID
- WPSEC-2026-1825
- Plugin
- ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO (thinkrank)
- Affected
- all versions before 2.19.0
- Remediation
- Update to 2.19.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- ThinkRank AI SEO on WPSec AttackSurface
- Fix released
- Published
Description
The ThinkRank AI SEO plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.18.1 due to incorrect authorization of ThinkRank capabilities assigned to roles that lack the baseline edit_posts capability. The Role Manager presents such grants as inactive until the role gains edit_posts, but the plugin's REST gate and most of its REST routes still honoured them. This makes it possible for authenticated attackers with Subscriber-level access, whose role has been given ThinkRank capabilities by an administrator, to modify plugin settings, including the stored AI API keys and the Role Manager capability assignments. Exploitation requires an administrator to have granted ThinkRank capabilities to a role without edit_posts, which is not the default.
References
- https://wpsec.com/vuln/WPSEC-2026-1825/
- https://plugins.svn.wordpress.org/thinkrank/tags/2.19.0/
- https://wordpress.org/plugins/thinkrank/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS