Wordlift – Ai Powered Seo – Schema
Approved changes feed: RSS · Atom
cpe:2.3:a:wordlift:wordlift_–_ai_powered_seo_–_schema:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Wordlift (ad64fb38-a7dc-5a7b-b146-a88dff64a04c) |
|---|---|
| Product | Wordlift – Ai Powered Seo – Schema (7d5c72d6-70e2-5761-ab96-05194d5cbf3c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9289 |
vulnerable | 2026-10-13 12:28:49.206703 |
WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
MEDIUM (5.3)
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.
Published: 2026-09-19T08:27:22.515Z
Updated: 2026-09-19T13:51:19.390Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12176 |
vulnerable | 2026-06-08 06:23:51.396629 |
WordLift – AI powered SEO – Schema <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
MEDIUM (5.3)
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings.
Published: 2025-01-07T04:22:19.089Z
Updated: 2026-04-08T17:22:10.540Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.