High-severity findings.

Audited release

2.3.0

Findings

5

Worst severity

high

Content hash

4d1b1b6b0facc1dc103c5827… Copy

Findings

• high Subscriber+ arbitrary plugin deactivation via nonce-only AJAX

  missing_capability

  wp_ajax_cpseo_deactivate_plugins verifies only nonce `cpseo-ajax-nonce` and never checks activate_plugins / manage_options. The same nonce is added to the classicSEO JS object for every logged-in user (including Subscriber) on both frontend and admin footers. A subscriber who copies classicSEO.security can POST plugin=<basename> and deactivate any installed plugin (security, firewall, this plugin, etc.), or plugin=all to deactivate competing SEO plugins via Detector::deactivate_all(). WordPress deactivate_plugins() does not re-check capabilities. Observable: the target plugin disappears from active_plugins and its admin UI/front hooks stop running.

  includes/admin/class-admin.php:328-338

  Recommendation

  Require current_user_can('activate_plugins') (and a dedicated nonce) before calling deactivate_plugins(). Stop publishing cpseo-ajax-nonce to roles that cannot use it.

• high Subscriber+ can create, restore, and delete SEO backups and wipe competitor plugin data

  missing_capability

  AJAX actions cpseo_create_backup, cpseo_delete_backup, cpseo_restore_backup, and cpseo_clean_plugin only call verify_nonce('cpseo-ajax-nonce'). import_plugin is the only sibling that also calls has_cap_ajax('general'). Because the nonce is in classicSEO.security for all logged-in users, a Subscriber can: (1) snapshot all SEO options/role-manager caps/redirections into cpseo_backups; (2) restore any snapshot via do_import_data(), which update_option's cpseo_modules, cpseo-options-general, cpseo-options-titles, cpseo-options-sitemap, runs Helper::set_capabilities() on role-manager data, and inserts redirection rows; (3) delete backups; (4) run Plugin_Importer::run_cleanup() for yoast/aioseo/rankmath/seo-framework, which DROP TABLE's plugin tables and deletes matching options/postmeta/usermeta/termmeta. Restore is a site-wide settings overwrite; cleanup is destructive data loss of other SEO plugins.

  includes/admin/class-import-export.php:97-181

  Recommendation

  Gate create/restore/delete backup and clean_plugin with has_cap_ajax('general') (or manage_options), matching import_plugin. Do not localize the AJAX nonce for users without that cap.

• high Author+ can create, update, or delete arbitrary site-wide redirects when saving a post

  missing_capability

  When the Redirections module is enabled, Metabox::save_advanced_meta runs on every SEO metabox save (cpseo/metabox/process_fields) for anyone who can edit a post/term and sees the metabox (authors have cpseo_onpage_general by default). It reads cpseo_redirection_url_to, cpseo_redirection_sources, cpseo_redirection_header_code, and cpseo_redirection_id directly from CMB2 data_to_save (the full POST). There is no Helper::has_cap('redirections') check and no restriction that the source pattern equals the current post permalink. An author can hidden-field POST a source of '' (homepage) or any path and a destination of https://attacker.example and DB::add() stores an active 301. Frontend Redirector then wp_redirect()s matching public traffic. The same handler deletes any redirection ID if url_to is empty. This bypasses the Role Manager cap that is supposed to protect the Redirections screen.

  includes/modules/redirections/class-metabox.php:97-134

  Recommendation

  Require Helper::has_cap('redirections') inside save_advanced_meta. Force the source pattern to the current object's permalink (ignore client-supplied cpseo_redirection_sources) and ignore cpseo_redirection_id unless it is already attached to that object.

• high Author+ can overwrite any post title via bulk-edit AJAX (no edit_post check)

  missing_capability

  wp_ajax_cpseo_bulk_edit_columns checks nonce plus has_cap_ajax('onpage_general') (true for Author/Editor by default) then iterates attacker-supplied rows[post_id]. For column image_title it calls wp_update_post({ID, post_title}) with no current_user_can('edit_post', $post_id) and no post-type restriction. wp_update_post does not check capabilities itself. An author can therefore rename any page, product, or another author's post (including the homepage) by POSTing rows[<id>][image_title]. Other columns write unsanitized post meta (cpseo__title / _wp_attachment_image_alt) for arbitrary IDs. The handler is reachable with the globally localized cpseo-ajax-nonce; the post-list script is only extra UX.

  includes/admin/class-post-columns.php:59-119

  Recommendation

  For each post_id, require current_user_can('edit_post', $post_id). Restrict image_title/image_alt to the attachment post type. Sanitize values before update_post_meta/wp_update_post.

• medium Author+ can mark any post, term, or user noindex/nofollow without ownership checks

  missing_capability

  wp_ajax_cpseo_mark_page_as requires onpage_general (Author+) and then update_meta($object_type, $object_id, 'cpseo_robots'|'cpseo_pillar_content', ...) using client-supplied objectID/objectType/what with no map to a post the user can edit. An author can noindex the homepage, another author's posts, or author archives, removing them from the index/sitemap consumers of cpseo_robots. Same global nonce as the other AJAX actions.

  includes/admin/class-admin-bar-menu.php:56-87

  Recommendation

  Resolve the object and require the matching edit capability (edit_post / manage_category / edit_user) for that ID before updating robots or pillar-content meta.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.