CVE-2026-12082: Praison AI SEO Auth Bypass Vulnerability

CVE-2026-12082 Overview

CVE-2026-12082 affects the Praison AI SEO WordPress plugin in versions before 5.0.7. The plugin fails to perform authorization checks on several of its REST API routes. Unauthenticated attackers can modify the permalink of any published post. They can also read plugin configuration data without authentication.

The vulnerability stems from missing capability checks in REST API endpoint handlers. Any remote user can invoke these routes and alter site content or exfiltrate configuration values. This classifies as a Broken Access Control weakness affecting REST API endpoints.

Critical Impact
Unauthenticated attackers can modify published post permalinks and read plugin configuration data through unprotected REST API routes.

Affected Products

Praison AI SEO WordPress plugin versions before 5.0.7
WordPress installations with the vulnerable plugin activated
Any published posts managed by the affected plugin

Discovery Timeline

2026-07-23 - CVE-2026-12082 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-12082

Vulnerability Analysis

The Praison AI SEO plugin registers REST API routes through the WordPress REST API framework. Several of these routes omit permission_callback enforcement or return true unconditionally. This design permits any HTTP client to invoke the endpoints without authentication.

One endpoint accepts requests to modify the permalink of any published post. A second endpoint returns configuration data associated with the plugin. Neither endpoint validates whether the caller holds an editor, administrator, or any authenticated role.

Root Cause

The root cause is missing authorization logic on REST route registration. In WordPress, REST endpoints must define a permission_callback that verifies user capabilities such as edit_posts or manage_options. The affected routes either lack this callback or use __return_true, which bypasses access control entirely.

Attack Vector

An attacker sends unauthenticated HTTP requests to the exposed REST routes. Modifying permalinks enables content redirection, SEO poisoning, and brand damage on the target site. Reading configuration data may expose API keys, integration secrets, or internal settings that support further attacks.

Exploitation requires only network access to the WordPress site. Refer to the WPScan Vulnerability Report for the endpoint details.

Detection Methods for CVE-2026-12082

Indicators of Compromise

Unauthenticated POST or PUT requests targeting /wp-json/ routes exposed by the Praison AI SEO plugin
Unexpected changes to post slug or permalink values in the wp_posts table
REST API access log entries lacking authentication cookies or nonces prior to permalink modifications
Outbound access attempts to URLs containing plugin configuration keywords

Detection Strategies

Audit WordPress access logs for requests to Praison AI SEO REST routes originating from unauthenticated sessions
Compare current post permalinks against historical backups to identify unauthorized modifications
Query the WordPress database for recent post_modified timestamps that lack corresponding editor activity

Monitoring Recommendations

Enable REST API request logging with source IP, user agent, and authentication context
Alert on HTTP 200 responses to /wp-json/praison* endpoints without an authenticated user
Monitor plugin file integrity and version state to confirm remediation

How to Mitigate CVE-2026-12082

Immediate Actions Required

Update the Praison AI SEO WordPress plugin to version 5.0.7 or later
Rotate any credentials or API keys stored in the plugin configuration that may have been exposed
Review published posts for unauthorized permalink changes and restore correct values
Restrict access to /wp-json/ at the web server or WAF layer for untrusted sources where feasible

Patch Information

The vendor addressed CVE-2026-12082 in Praison AI SEO WordPress plugin version 5.0.7. The patch adds proper permission_callback enforcement to the affected REST API routes. Consult the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Deactivate the Praison AI SEO plugin until the site can be updated to version 5.0.7
Deploy a Web Application Firewall rule blocking unauthenticated requests to the plugin's REST routes
Restrict REST API access to authenticated users through a security plugin or custom rest_authentication_errors filter

bash

# Example: block unauthenticated access to plugin REST routes via .htaccess
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
  RewriteRule ^wp-json/praison(.*)$ - [F,L]
</IfModule>