CVE-2026-9289

MediumCVSS 5.3

Published: 19/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

The WordLift – AI powered SEO – Schema plugin for WordPress in all versions up to and including 3.54.10 is vulnerable to Sensitive Information Exposure via the JSON-LD REST API endpoints. The /wordlift/v1/jsonld/ routes are registered with a permission_callback of '__return_true', and the converter retrieves posts via get_post() without verifying post status or user capabilities, allowing unauthenticated attackers to read metadata of private, draft, and pending posts.

Risk Assessment

An unauthenticated attacker can read titles, content, authors, and other metadata of private, draft, and pending posts, bypassing WordPress core access controls. This may lead to leakage of confidential information and exposure of unpublished content.

Recommendation

Update the WordLift plugin to a version newer than 3.54.10 as soon as it becomes available. Until a fix is released, consider disabling the plugin or restricting access to the /wordlift/v1/jsonld/ endpoints, and review logs for unauthorized access.

Other vulnerabilities in WordLift

CVE-2026-110891Medium
The WordLift plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WordLift from n/a through 3.54.15.

Original NVD description (English source)

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS