CVE-2026-9289: WordLift WordPress Plugin Data Leak Flaw

CVE-2026-9289 Overview

CVE-2026-9289 is a sensitive information exposure vulnerability in the WordLift – AI powered SEO – Schema plugin for WordPress. All versions up to and including 3.54.10 are affected. The flaw resides in the /wordlift/v1/jsonld/ REST API routes, which register a permission_callback of __return_true and delegate to a converter that fails to verify post status or user capabilities. Unauthenticated attackers can enumerate post IDs to read titles, content, authors, publication and modification dates, word counts, comment counts, and other metadata from private, draft, and pending posts.

Critical Impact
Unauthenticated remote attackers can read non-public WordPress post content and metadata by bypassing WordPress core access controls through the plugin's JSON-LD REST API endpoints.

Affected Products

WordLift – AI powered SEO – Schema plugin for WordPress
All versions up to and including 3.54.10
Sites exposing the /wp-json/wordlift/v1/jsonld/ REST API routes

Discovery Timeline

2026-09-19 - CVE-2026-9289 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-9289

Vulnerability Analysis

The vulnerability is classified as Information Exposure [CWE-200]. WordLift registers several REST API endpoints under the /wordlift/v1/jsonld/ namespace, including jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}. Each of these routes uses permission_callback => '__return_true', which authorizes every incoming request regardless of authentication state.

The downstream Wordlift_Post_To_Jsonld_Converter retrieves the target post using get_post() without invoking current_user_can() or checking the post's post_status. WordPress core normally restricts access to private, draft, pending, and future posts through capability checks. Because the plugin bypasses those checks, non-public content becomes readable through the JSON-LD response payload.

Root Cause

The root cause is missing authorization on REST API routes combined with the absence of post-status validation in the converter. The permission_callback of __return_true is a WordPress anti-pattern that explicitly disables access control on the endpoint. Combined with an unrestricted get_post() call, this produces a broken access control condition that exposes internal content to any anonymous requester.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker issues sequential HTTP GET requests to /wp-json/wordlift/v1/jsonld/jsonld/{id} and enumerates numeric post IDs. For each ID, the JSON-LD response returns the post title, description or content, author, publication and modification timestamps, word count, and comment count. Additional routes such as jsonld/post-meta/{meta_key} and jsonld/meta/{meta_key} allow retrieval of custom post metadata that may include sensitive business information staged in unpublished drafts.

Refer to the WordLift JSON-LD By ID Endpoint source and the WordLift Post to JSON-LD Converter source for the affected code paths.

Detection Methods for CVE-2026-9289

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/wordlift/v1/jsonld/ routes originating from a small number of source IPs
Sequential or high-volume enumeration of numeric post IDs against the jsonld/{id} endpoint
HTTP 200 responses from jsonld/post-meta/{meta_key} or jsonld/meta/{meta_key} requests that reference unpublished content

Detection Strategies

Parse web server access logs for requests matching the path pattern /wp-json/wordlift/v1/jsonld/* and correlate against the source IP request rate
Compare JSON-LD response post IDs against the WordPress database to identify accesses to non-publish post statuses
Alert on any unauthenticated request that returns metadata belonging to private, draft, or pending posts

Monitoring Recommendations

Enable REST API request logging in WordPress and forward the events to a centralized log platform for retention and correlation
Track anomalous spikes in requests to WordLift endpoints, especially outside normal crawler patterns
Review the Wordfence CVE Vulnerability Report for additional signatures and detection guidance

How to Mitigate CVE-2026-9289

Immediate Actions Required

Update the WordLift – AI powered SEO – Schema plugin to a version later than 3.54.10 as soon as a patched release is available
Audit web server and WordPress logs for prior unauthenticated access to /wp-json/wordlift/v1/jsonld/ routes
Identify sensitive content currently held in draft, pending, or private posts and rotate any credentials or business data that may have been exposed

Patch Information

Review the WordLift Changeset Analysis for the vendor code changes addressing this issue. Confirm the installed plugin version in the WordPress admin plugins screen and apply the vendor-supplied update through the standard WordPress update workflow.

Workarounds

Restrict access to the /wp-json/wordlift/v1/jsonld/ REST routes at the web application firewall (WAF) or reverse proxy layer until the patched version is installed
Disable the WordLift plugin on sites that host unpublished sensitive content and do not require JSON-LD output
Enforce authentication on the WordPress REST API by requiring valid nonces or application passwords for all /wp-json/ traffic where feasible

bash

# Example nginx location block to block unauthenticated access to the vulnerable routes
location ~ ^/wp-json/wordlift/v1/jsonld/ {
    deny all;
    return 403;
}