# ThinkRank AI SEO <= 2.18.1 - Authenticated (Subscriber+) Privilege Escalation via ThinkRank Capabilities Granted to Roles Without edit_posts

- **ID:** WPSEC-2026-1825
- **Plugin:** ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO (`thinkrank`), https://wordpress.org/plugins/thinkrank/
- **Affected versions:** all versions before 2.19.0
- **Fixed in:** 2.19.0 (Update to 2.19.0 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/thinkrank
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1825/

## Description

The ThinkRank AI SEO plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.18.1 due to incorrect authorization of ThinkRank capabilities assigned to roles that lack the baseline edit_posts capability. The Role Manager presents such grants as inactive until the role gains edit_posts, but the plugin's REST gate and most of its REST routes still honoured them. This makes it possible for authenticated attackers with Subscriber-level access, whose role has been given ThinkRank capabilities by an administrator, to modify plugin settings, including the stored AI API keys and the Role Manager capability assignments. Exploitation requires an administrator to have granted ThinkRank capabilities to a role without edit_posts, which is not the default.

## References

- https://wpsec.com/vuln/WPSEC-2026-1825/
- https://plugins.svn.wordpress.org/thinkrank/tags/2.19.0/
- https://wordpress.org/plugins/thinkrank/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1825/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.