https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 23:21:21 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-76780 <p>The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the &#39;rankingcoach_write_redirectManager&#39; (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes &#39;contributor&#39;, combined with the module&#39;s REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can(&#39;rankingcoach_write_&lt;module&gt;&#39;) and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.</p> <p>The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the &#39;rankingcoach_write_redirectManager&#39; (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes &#39;contributor&#39;, combined with the module&#39;s REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can(&#39;rankingcoach_write_&lt;module&gt;&#39;) and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.</p> https://db.gcve.eu/vuln/fkie_cve-2026-76780 https://db.gcve.eu/vuln/ghsa-8q7r-cf36-8v8v <p>The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the &#39;rankingcoach_write_redirectManager&#39; (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes &#39;contributor&#39;, combined with the module&#39;s REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can(&#39;rankingcoach_write_&lt;module&gt;&#39;) and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.</p> <p>The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the &#39;rankingcoach_write_redirectManager&#39; (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes &#39;contributor&#39;, combined with the module&#39;s REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can(&#39;rankingcoach_write_&lt;module&gt;&#39;) and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login.</p> https://db.gcve.eu/vuln/ghsa-8q7r-cf36-8v8v