CVE-2026-13703 is an improper access control vulnerability (CWE-284) in the SEO Redirection Plugin for WordPress. Versions prior to 9.19 do not verify user capabilities in an authenticated AJAX action, enabling any logged-in user to access sensitive configuration data related to 301 redirects. This information disclosure could reveal site structure or redirect logic that is intended to be restricted.

The vulnerability allows unauthorized disclosure of the site's 301 redirect rules to any authenticated user, including those with minimal privileges. This exposure could aid an attacker in reconnaissance or planning further attacks by revealing internal URL mappings and redirect destinations. There is no indication of direct code execution or privilege escalation from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles that can log in or monitor for unusual access patterns to the AJAX action. Upgrading to version 9.19 or later, if confirmed by the vendor, would be the recommended remediation once a patch is released.