CVE-2026-9289

Overview

The WordLift plugin for WordPress contains a sensitive information exposure vulnerability in its JSON-LD REST API endpoints. Unauthenticated attackers can retrieve post data by enumerating identifiers due to missing capability and post status checks. This matters because it exposes private, draft, and pending content to unauthorized users.

Description

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.

Impact

This vulnerability impacts the confidentiality of WordPress sites utilizing the affected plugin by leaking metadata, titles, and content of non-public posts. Unauthenticated remote users can read draft and private information, bypassing standard core access controls. The integrity and availability of the system remain unaffected, but internal planning and unpublished content are compromised.

Remediation

Update the WordLift plugin to a version later than 3.54.10 immediately upon availability of a security patch. As an interim mitigation, disable the plugin if the functionality is not business-critical or implement strict IP access controls on the WordPress REST API endpoints.

Risk context

The vulnerability is rated as medium severity with a CVSS score of 5.3, reflecting a targeted impact on confidentiality without system-wide compromise. The EPSS value of 0.00356 indicates a relatively low current probability of exploitation in the wild, though defenders should prioritize remediation due to the ease of automated enumeration.

Affected products

• WordLift plugin for WordPress