CVE-2026-9289

Received Received - Intake

Sensitive Information Exposure in WordLift SEO Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-9289

Affected Vendors & Products

Vendor	Product	Version / Range
wordlift	ai_powered_seo_schema_plugin	to 3.54.10 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The WordLift plugin for WordPress exposes sensitive metadata of private posts through unrestricted JSON-LD REST API endpoints. Unauthenticated attackers can access titles, content, author details, and other metadata of draft or private posts by guessing post IDs, bypassing WordPress access controls.

Detection Guidance

Check WordPress sites using WordLift plugin versions up to 3.54.10 for unauthorized access to JSON-LD REST API endpoints. Monitor logs for unusual requests to /wordlift/v1/jsonld/ routes. Use tools like curl to test if sensitive post metadata is exposed by querying these endpoints with different post IDs.

Impact Analysis

Attackers could gather unpublished content, metadata, or drafts from your WordPress site without authentication. This may lead to data leaks, intellectual property theft, or preparation for further attacks targeting sensitive information.

Mitigation Strategies

Update the WordLift plugin to the latest version immediately. If an update is unavailable, disable the plugin temporarily. Review and restrict access to the /wordlift/v1/jsonld/ endpoints via server configuration. Implement additional authentication or IP restrictions for these routes.

Hi! I’m here to help you understand CVE-2026-9289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70