Executive brief
The Praison AI SEO plugin for WordPress, which helps automate search engine optimization, contains a security flaw that allows unauthorized individuals to modify website content. Specifically, an attacker can change the web addresses (permalinks) of existing blog posts and access internal plugin configuration settings. This could lead to broken links, disrupted search engine rankings, and the exposure of technical site information.
Technical details
The Praison AI SEO plugin fails to implement proper authorization checks (CWE-862) on multiple REST API endpoints. Specifically, the '/wp-json/aiseo/v1/permalink/optimize', '/wp-json/aiseo/v1/redirects/', and '/wp-json/aiseo/v1/analytics' routes are accessible to unauthenticated remote attackers. By sending crafted POST requests to these endpoints, an attacker can trigger the optimization (modification) of slugs for any published post ID, create redirect entries, or retrieve sensitive plugin configuration and analytics data. While the redirect engine in version 5.0.6 was reportedly not fully hooked to the front-end, the ability to modify post permalinks can cause immediate SEO degradation and broken internal links. The issue is resolved in version 5.0.7.
Affected products
- Unknown Praison AI SEO < 5.0.7
Timeline
- 2026-07-02: disclosed: Initial public disclosure by researcher
- 2026-07-23: advisory: NVD publication date