Rank Math SEO CVE-2025-64350
LOWSeverity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
High privilege required to reach the unguarded endpoint; limited integrity and availability impact only, no data exposure.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1.
AnalysisAI
Missing authorization checks in Rank Math SEO WordPress plugin (versions through 1.0.252.1) allow authenticated high-privilege users to perform actions that exceed their intended access level, resulting in limited integrity and availability impact. The vulnerability stems from incorrectly configured access control security levels (CWE-862), enabling exploitation of plugin functionality without proper capability verification. No public exploit exists and EPSS remains at 0.01% (3rd percentile), indicating negligible real-world exploitation pressure at time of analysis.
Technical ContextAI
Rank Math SEO (WordPress plugin slug: seo-by-rank-math) is a feature-rich SEO optimization plugin for WordPress. CWE-862 (Missing Authorization) indicates that one or more plugin endpoints - likely REST API routes or WordPress AJAX actions - fail to perform adequate capability checks before executing sensitive operations. In WordPress, proper authorization gates use functions such as current_user_can() against appropriate capabilities (e.g., manage_options, edit_posts). When these checks are absent or misconfigured, the access control model breaks down. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U reflects that exploitation occurs over the network with low complexity but requires high-privilege authentication, scoped to the vulnerable system only. The tag 'Authentication Bypass' likely refers to bypassing authorization at the action/capability layer rather than authentication itself - a common distinction in WordPress plugin audits.
Affected ProductsAI
Rank Math SEO WordPress plugin (seo-by-rank-math) versions from the earliest release through and including 1.0.252.1 are confirmed affected per the Patchstack advisory. No lower version bound is specified ('from n/a'), implying all prior versions may also carry the flaw. CPE data is not explicitly provided in the source intelligence, but the affected product maps to the WordPress.org plugin ecosystem. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/seo-by-rank-math/vulnerability/wordpress-rank-math-seo-plugin-1-0-252-1-broken-access-control-vulnerability should be consulted for the most current scope.
RemediationAI
The primary remediation is to update Rank Math SEO to a version released after 1.0.252.1 - an exact patched version number is not independently confirmed in the available intelligence, and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/seo-by-rank-math/vulnerability/wordpress-rank-math-seo-plugin-1-0-252-1-broken-access-control-vulnerability should be checked for the confirmed fixed release. Patch available per vendor advisory (upstream fix status). As a compensating control pending upgrade, restrict WordPress admin account access to trusted users only and review active admin-level accounts for unnecessary privilege assignments - this limits the pool of users who could trigger the flaw. In WordPress multisite environments, audit sub-site admin capability assignments more carefully, as missing authorization flaws carry higher cross-boundary risk there. Disabling the specific plugin functionality tied to the broken access control is an option only if the exact affected feature can be identified from the Patchstack advisory details.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today