Unauthorized Access in Beyondseo Plugin for WordPress

CVE-2026-76780

What is CVE-2026-76780?

The Beyondseo plugin for WordPress suffers from a vulnerability that allows authenticated users with Contributor-level access to elevate their privileges to Administrator level. This flaw arises because the plugin improperly grants certain capabilities to the Contributor role, enabling attackers to manipulate site-wide redirects without appropriate authorization checks. By leveraging the associated REST endpoints, an attacker can create, update, or delete 301/302 redirects, which could potentially redirect users to malicious paths, compromising the integrity of the site. This vulnerability highlights the critical importance of stringent access controls and capability management within WordPress plugins.

References