In BeyondSEO plugin versions up to and including 1.3.6, the capability system assigns the ability to create, modify, or delete redirect rules to the WordPress Contributor role. Those REST endpoints are protected only by a simple capability check, without requiring an administrator role, ownership checks, or nonce verification. An authenticated user with Contributor privileges can therefore instruct the plugin to manipulate 301/302 redirects that are executed on every frontend visitor, enabling path hijacking and potentially deceptive inbound traffic. This escalation does not grant full administrative rights, but it does give a contributor the power to alter site navigation, inject malicious redirects, and facilitate phishing or credential‑stealing attacks.

WordPress sites using the BeyondSEO plugin from RankingCoach, versions 1.3.6 or older. The vulnerability exists in all installations where the plugin has been activated and the default WordPress capability set is in use. No other products or older plugin variations are known to be affected as per current public data.

The listed CVSS score of 6.3 indicates a moderate severity but high impact due to the ease of exploitation—any authenticated Contributor can trigger the flaw. No EPSS score is available, and the vulnerability is not yet in the CISA KEV catalog, suggesting limited public exploitation to date. However, the threat vector is straightforward: an attacker who can obtain Contributor access, which many sites permit to casual content creators, can permanently elevate their privileges to administer redirects site‑wide. Once gained, the attacker can redirect legitimate user traffic to malicious sites, potentially compromising site integrity and user trust.