CVE-2026-110891

MediumCVSS 5.4

Published: 15/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The WordLift plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WordLift from n/a through 3.54.15.

Risk Assessment

An attacker may perform actions they should not be permitted to, because access control is insufficient. This can lead to unauthorized modification or disclosure of data.

Recommendation

Update the WordLift plugin to a version later than 3.54.15. Review user role permissions and restrict access to administrative functions.

Other vulnerabilities in WordLift

CVE-2026-9289Medium
The WordLift – AI powered SEO – Schema plugin for WordPress in all versions up to and including 3.54.10 is vulnerable to Sensitive Information Exposure via the JSON-LD REST API endpoints. The /wordlift/v1/jsonld/ routes are registered with a permission_callback of '__return_true', and the converter retrieves posts via get_post() without verifying post status or user capabilities, allowing unauthenticated attackers to read metadata of private, draft, and pending posts.

Original NVD description (English source)

Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through 3.54.15.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS