Sensitive Information Exposure in WordLift – AI Powered SEO Plugin for WordPress
CVE-2026-9289

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Wordlift – Ai Powered Seo – Schema
Vendor
CVE Published:
19 September 2026

What is CVE-2026-9289?

The WordLift – AI powered SEO – Schema plugin for WordPress has a vulnerability that allows unauthenticated attackers to access sensitive metadata from private, draft, and pending posts through the JSON-LD REST API endpoints. This is due to inadequate permission checks, which enable attackers to bypass access controls, potentially exposing critical information such as post titles, content, authorship details, and other metadata.

Affected Version(s)

WordLift – AI powered SEO – Schema 0 <= 3.54.10

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wordlift/tags/...
https://plugins.trac.wordpress.org/browser/wordlift/tags/...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Benedictus Jovan (aillesiM)
.