Description

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-19T09:16:34.917Z",
  "pubdate": "2026-09-19T09:16:34.917Z",
  "executiveSummary": "The WordLift – AI powered SEO – Schema plugin for WordPress is susceptible to a Sensitive Information Exposure vulnerability affecting versions up to and including 3.54.10.\nThe vulnerability originates from the insecure registration of JSON-LD REST API endpoints, which lack necessary authentication checks.\nThis flaw permits unauthenticated remote attackers to bypass WordPress core access controls, enabling unauthorized retrieval of sensitive metadata from non-public posts.\nBy manipulating the API request structure, an attacker can access draft, pending, and private post content, including titles, descriptions, author details, and publication metadata.\nThe risk is categorized as high due to the exposure of potentially confidential organizational data and the triviality of the exploitation process, which requires no prior authentication or administrative privileges.\nThis impact underscores a critical failure in the plugin's REST API permission handling, necessitating immediate updates to ensure that downstream data retrieval operations respect established WordPress user capability constraints.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of the REST API route registration within the WordLift plugin. Specifically, the plugin registers multiple routes under the /wordlift/v1/jsonld/ namespace, including endpoints such as jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}.\nDuring the registration process for these routes, the plugin utilizes a permission_callback function set to '__return_true'. This configuration explicitly instructs the WordPress REST API infrastructure to bypass all authorization checks, effectively granting access to any remote actor regardless of their authentication state or assigned user roles.\nUpon reaching the endpoint, the downstream converter component invokes the get_post() function to retrieve post data based on the provided parameters. Crucially, the plugin fails to implement secondary validation logic to verify the current post status (e.g., 'publish', 'draft', 'pending', 'private') or to cross-reference the requesting user's capabilities against the target object's visibility settings. As a result, the plugin fetches and serves post data that should remain restricted to authenticated administrators or authorized editors.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the vulnerable API structure through manual inspection or automated discovery of the /wordlift/v1/jsonld/ routes. By iterating through potential post IDs or guessing post names, the attacker crafts HTTP GET requests to the specified endpoints. Because the permission_callback is universally permissive, the plugin processes the request and transmits a JSON-LD payload containing the sensitive data associated with the requested ID.\nThis payload exposes a wide array of metadata, including post titles, raw content or descriptions, author identifiers, internal publication/modification timestamps, word counts, and comment counts. The exploitation is entirely network-based and can be automated to facilitate large-scale information scraping or content reconnaissance, bypassing the standard access controls implemented within the WordPress core framework."
}