Executive brief
The WordLift plugin for WordPress, used to optimize search engine visibility through structured data, exposes private and draft post content to unauthenticated attackers. By directly accessing REST API endpoints without proper permission checks, attackers can read sensitive post metadata including titles, content, author information, and publication dates from unpublished posts, bypassing WordPress access controls.
Technical details
The plugin registers JSON-LD REST API endpoints (/wordlift/v1/jsonld/*) with a permission callback that always returns true, allowing unauthenticated access. The downstream converter retrieves posts via get_post() without verifying post status or user capabilities, enabling enumeration of post IDs to extract metadata from private, draft, and pending posts. Attackers can bypass WordPress core access controls through network-based enumeration without authentication.
Affected products
- WordLift AI powered SEO – Schema up to and including 3.54.10
Timeline
- 2026-09-19: disclosed