The Beyondseo WordPress plugin versions up to and including 1.3.6 contain an authorization vulnerability that allows users with Contributor-level access to escalate privileges. This occurs because the plugin grants elevated capabilities to the Contributor role without sufficient permission checks on REST API endpoints managing redirects. Exploiting this flaw, an attacker can create, update, or delete site-wide redirects, potentially hijacking arbitrary paths such as /checkout or /wp-login.