{"id":"CVE-2026-9289","aliases":["EUVD-2026-83565","GHSA-r68q-w69r-5c82"],"status":"published","title":"WordLift \u003c= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00618,"percentile":0.49897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-09-19T08:27:22Z","modified":"2026-09-21T13:33:33Z","products":[{"vendor":"unknown","product":"wordlift – ai powered seo – schema"},{"vendor":"wordlift","product":"wordlift – ai powered seo – schema"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96d8da55-0706-42b6-8423-260f6138387d?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.10/classes/jsonld/class-jsonld-endpoint.php#L131"},{"url":"https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.10/classes/jsonld/class-jsonld-endpoint.php#L57"},{"url":"https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.10/includes/class-wordlift-post-to-jsonld-converter.php#L81"},{"url":"https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.10/classes/jsonld/class-jsonld-by-id-endpoint.php#L112"},{"url":"https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.8/classes/jsonld/class-jsonld-endpoint.php#L131"},{"url":"https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.8/classes/jsonld/class-jsonld-endpoint.php#L57"},{"url":"https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.8/includes/class-wordlift-post-to-jsonld-converter.php#L81"},{"url":"https://plugins.trac.wordpress.org/browser/wordlift/tags/3.54.8/classes/jsonld/class-jsonld-by-id-endpoint.php#L112"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3597515%40wordlift\u0026new=3597515%40wordlift"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9289"},{"url":"https://github.com/advisories/GHSA-r68q-w69r-5c82"}],"sources":{"cve":[{"id":"CVE-2026-9289","title":"WordLift \u003c= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.","status":"published","published":"2026-09-19T08:27:22.515Z","modified":"2026-09-19T13:51:19.39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:42:26.790871Z"}],"euvd":[{"id":"EUVD-2026-83565","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.","status":"published","published":"2026-09-19T08:27:22Z","modified":"2026-09-19T13:51:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:06.658724Z"}],"ghsa":[{"id":"GHSA-r68q-w69r-5c82","title":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive...","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.","status":"published","published":"2026-09-19T09:32:12Z","modified":"2026-09-19T09:32:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:13.368323Z"}],"nvd":[{"id":"CVE-2026-9289","description":"The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.","status":"published","published":"2026-09-19T09:16:34.917Z","modified":"2026-09-21T13:33:33.387Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:50.043898Z"}]}}