Description

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T06:16:25.290Z",
  "pubdate": "2026-09-12T06:16:25.290Z",
  "executiveSummary": "The SureRank SEO WordPress plugin, specifically versions prior to 1.10.1, contains an Information Disclosure vulnerability.\nThe vulnerability arises from the insecure handling of structured data generation, where the plugin includes the registered email addresses of site authors in the JSON-LD or microdata output rendered on public-facing pages.\nThis flaw allows unauthenticated, remote attackers to systematically enumerate and harvest the email addresses of registered WordPress users who have published content on the site.\nThe impact includes an increased risk of targeted phishing attacks, credential stuffing, and user privacy violation.\nNo specific authentication or specialized privileges are required to exploit this vulnerability, as the sensitive information is exposed via public web pages.\nThe risk is categorized as significant due to the ease of automation for scraping this data, potentially leading to widespread PII (Personally Identifiable Information) leakage across affected installations.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's structured data implementation, which fails to sanitize or filter user profile data before injecting it into the Document Object Model (DOM) of public pages.\nSpecifically, the plugin logic responsible for generating Schema.org markup pulls author information directly from the WordPress user object without validating whether the email field should be exposed publicly.\nIn WordPress, the user email address is a sensitive field typically meant for administrative and notification purposes, not public exposure.\nThe attack flow proceeds as follows: An unauthenticated attacker navigates to any public post or page on a WordPress site utilizing the vulnerable SureRank SEO version. The plugin renders structured data (typically in a <script type=\"application/ld+json\"> block) to assist search engines in indexing the content. Within this structured data block, the plugin includes the 'email' property of the author, retrieved via WordPress functions such as 'get_userdata()'.\nBecause this information is rendered in the HTML response body, an attacker can programmatically scrape site content—specifically identifying authors associated with posts—and extract their email addresses directly from the source code or rendered JSON-LD object.\nThis exposure persists across all posts authored by registered users, allowing an attacker to map out a complete directory of active contributors and their corresponding email addresses with minimal effort.\nThe vulnerability exists in the plugin's core structured data generation routines. Affected versions include all releases prior to 1.10.1. Because the exposure occurs during standard page rendering, the vulnerability is accessible to any network client capable of requesting the page.\nPost-exploitation, the gathered email addresses can be utilized for malicious activities such as social engineering, targeted phishing campaigns, or the brute-forcing of accounts if the email addresses are associated with weak password policies on other platforms.\nThe lack of an access control check or a configuration setting to disable the inclusion of email fields in schema generation represents a failure to adhere to the principle of least privilege regarding data exposure."
}