{"id":"CVE-2024-12176","aliases":["EUVD-2024-50650","GHSA-gxw6-23qm-f8vw"],"status":"published","title":"WordLift – AI powered SEO – Schema \u003c= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00326,"percentile":0.25978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-01-07T04:22:19Z","modified":"2026-06-17T06:59:11Z","products":[{"vendor":"unknown","product":"wordlift – ai powered seo – schema"},{"vendor":"wordlift","product":"wordlift – ai powered seo – schema"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6bdde6-f381-4ccb-8984-519cf9aca0b1?source=cve"},{"url":"https://wordpress.org/plugins/wordlift/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12176"},{"url":"https://wordpress.org/plugins/wordlift"},{"url":"https://github.com/advisories/GHSA-gxw6-23qm-f8vw"}],"sources":{"cve":[{"id":"CVE-2024-12176","title":"WordLift – AI powered SEO – Schema \u003c= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings.","status":"published","published":"2025-01-07T04:22:19.089Z","modified":"2026-04-08T17:22:10.54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:12.635756Z"}],"euvd":[{"id":"EUVD-2024-50650","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings.","status":"published","published":"2025-01-07T04:22:19Z","modified":"2026-04-08T17:22:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:40.44402Z"}],"ghsa":[{"id":"GHSA-gxw6-23qm-f8vw","title":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access...","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all versions up to, and including, 3.54.0. This makes it possible for unauthenticated attackers to update the plugin's settings.","status":"published","published":"2025-01-07T06:32:15Z","modified":"2025-01-07T06:32:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:59:22.508847Z"}],"nvd":[{"id":"CVE-2024-12176","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings.","status":"published","published":"2025-01-07T05:15:15.9Z","modified":"2026-06-17T06:59:11.077Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:41.838321Z"}]}}