EUVD-2025-209984
GHSA-gxcw-fm99-9f74
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Rank Math SEO ≤1.0.271
-
DeliverySend unauthenticated HTTP POST to update_site_editor_homepage REST endpoint
-
ExploitMissing capability check allows write access
-
ExecutionOverwrite homepage title, meta description, breadcrumb labels, and social metadata
-
ImpactMalicious content propagated sitewide via breadcrumb rendering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the Rank Math SEO plugin being installed and active on a WordPress site running any version up to and including 1.0.271. The CVSS vector PR:N confirms no authentication is required. The REST API endpoint is reachable over the network by default on any standard WordPress installation. Exploitation is limited to integrity impact against SEO metadata and breadcrumb content only - there is no code execution or data exfiltration path indicated. Sites that have disabled the WordPress REST API entirely, or have restricted it to authenticated users via a hardening plugin, would not be exploitable. |
| Impact | The CVSS 3.1 base score of 5.3 (Medium) reflects AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - a network-reachable, low-complexity, unauthenticated attack with limited integrity impact and no confidentiality or availability impact. The I:L rating technically understates business risk for SEO-dependent sites: an attacker can silently poison homepage metadata and breadcrumb labels sitewide, potentially ranking malicious content or defacing social sharing previews. No EPSS score was provided, and neither CISA KEV listing nor confirmed public POC code was reported, suggesting exploitation has not yet been observed at scale. The attack is fully automatable (AC:L, PR:N, UI:N), making mass scanning of WordPress installations for this plugin plausible. Real-world prioritization should be elevated for any site where SEO integrity is business-critical, despite the moderate CVSS score. |
| Exploit ScenarioDerived | An attacker enumerates WordPress sites running Rank Math SEO plugin versions up to 1.0.271 using passive fingerprinting or active scanning of |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Unauthenticated modification of SEO metadata settings is possible in the Rank Math SEO WordPress plugin through version 1.0.271, stemming from a missing authorization check on the REST API function update_site_editor_homepage. Remote, unauthenticated attackers can overwrite homepage title, meta descriptions, breadcrumb labels, and social media metadata, enabling SEO poisoning campaigns and injection of malicious content into breadcrumb components rendered sitewide. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity and requires no authentication.
RemediationAI
Update the Rank Math SEO plugin to a version beyond 1.0.271. The upstream fix was committed to the WordPress plugin repository as changeset 3552223, patching includes/rest/class-rest-helper.php to enforce capability verification on the affected REST endpoint; released patched version beyond 1.0.271 is confirmed by the changeset but the exact tagged release version was not independently verified from available data - verify via the WordPress plugin update page or https://plugins.trac.wordpress.org/changeset/3552223/seo-by-rank-math/trunk/includes/rest/class-rest-helper.php. If immediate patching is not possible, a compensating control is to use a WordPress firewall plugin (e.g., Wordfence) to block unauthenticated REST API requests targeting Rank Math endpoints; note this may break legitimate frontend block editor functionality dependent on those endpoints. Restricting public REST API access at the server level (e.g., blocking /wp-json/rankmath/ to non-authenticated traffic via nginx/Apache rules) is also effective but requires testing against site functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-862 (Missing Authorization) within the Rank Math SEO plugin's WordPress REST API layer. The affected function update_site_editor_homepage, located in includes/rest/class-shared.php (lines 122, 129, and 339 per source references), exposes a REST endpoint that modifies plugin-managed SEO settings without verifying whether the requesting user holds appropriate WordPress capabilities. WordPress relies on capability checks (e.g., current_user_can()) to gate privileged REST endpoints; their absence here allows any unauthenticated HTTP client to invoke the function. The fix, per changeset 3552223, was applied to includes/rest/class-rest-helper.php at line 75, indicating a centralized REST helper was patched to enforce authorization. The CPE string cpe:2.3:a:rankmath:rank_math_seo_-_ai_seo_tools_to_dominate_seo_rankings:*:*:*:*:*:*:*:* confirms all plugin releases up to and including 1.0.271 are affected.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Rank Math SEO - AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to modify several plugin settings including homepage title, meta description, breadcrumbs label, and social media metadata, which can have severe impact on SEO rankings and display malicious content across all site pages where breadcrumbs are used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB