CVE-2026-76780
Received Received - Intake

Beyondseo Plugin Unauthorized Privilege Escalation in WordPress

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Wordfence

Description
The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-76780
EUVD
EUVD-2026-111611

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Beyondseo WordPress plugin up to version 1.3.6 has an unauthorized access flaw. It permanently grants Contributor role users the ability to manage site redirects through capabilities like rankingcoach_write_redirectManager. The plugin's REST endpoints only check these capabilities without additional admin or ownership verification, allowing Contributor-level attackers to create, modify, or delete redirects. These redirects are then executed for all site visitors, enabling path hijacking such as targeting /checkout or /wp-login.

Detection Guidance

Check WordPress user roles for unauthorized 'rankingcoach_write_*' capabilities assigned to Contributor or higher roles. Inspect plugin files for BaseModule::defineCapabilities() and REST endpoints like registerRouteCreate/registerRouteEdit/registerRouteDelete in the Beyondseo plugin.

Impact Analysis

If you use the affected plugin, attackers with Contributor access could escalate privileges to effectively Administrator level for redirect management. They could hijack critical site paths like checkout or login pages, redirecting users to malicious sites. This could lead to phishing attacks, data theft, or site defacement. The impact depends on the attacker's goals and the site's traffic.

Compliance Impact

This vulnerability allows Contributor-level users to escalate privileges and modify site-wide redirects, potentially exposing sensitive user data like login pages or checkout paths. Such unauthorized access could lead to data breaches, violating GDPR (data protection) and HIPAA (healthcare data privacy) compliance requirements.

Mitigation Strategies

Update the Beyondseo plugin to the latest version if available. Remove 'rankingcoach_write_*' capabilities from Contributor roles via WordPress role management plugins or custom code. Disable the plugin temporarily if an update is not available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart