The BeyondSEO WordPress plugin up to version 1.3.6 improperly grants elevated redirect management capabilities to the Contributor role. This allows authenticated users with Contributor-level access or higher to create, update, or delete site-wide redirects without additional authorization checks. Such unauthorized redirect control can lead to hijacking of arbitrary site paths, including sensitive endpoints like /checkout and /wp-login.