Rank Math SEO CVE-2025-64350

Requires an authenticated WordPress administrator account (PR:H per CVSS vector) - exploitation is not possible by unauthenticated users or lower-privileged roles such as Editor, Author, Contributor, or Subscriber. The vulnerable endpoint is accessible over the network (AV:N), so no local server access is needed once admin credentials are held. Rank Math SEO plugin must be installed and active on the target WordPress installation. No special non-default configuration is required beyond plugin presence; however, the low-complexity exploitation is limited by the hard prerequisite of high-privilege authentication. In WordPress Multisite deployments, the risk surface may be elevated if sub-site admins can cross privilege boundaries - this condition is inferred from the vulnerability class and is not explicitly confirmed. Exploitation impact is bounded to minor integrity and availability effects (I:L, A:L); confidentiality is not impacted.

The overall risk is low. CVSS scores 3.8 with PR:H, meaning exploitation is limited to already highly privileged users (WordPress admins), which substantially constrains the attack surface. EPSS at 0.01% (3rd percentile) confirms that the broader security community assesses exploitation likelihood as very low. No KEV listing and no public exploit code exist. The impact is bounded to low integrity (I:L) and low availability (I:L) with zero confidentiality exposure (C:N), meaning an attacker cannot read sensitive data - only cause minor disruption or modification. In practical terms, if an attacker already has WordPress admin credentials, they have far more direct and impactful paths of attack than exploiting a missing authorization check for marginal extra capability. This vulnerability is likely of higher consequence in WordPress multisite environments, where a sub-site admin might cross privilege boundaries into network-admin-level actions - but this scenario is inferred from the vulnerability class, not confirmed in available data. SSVC signals align: no active exploitation, non-automatable at scale due to PR:H, and limited technical impact.

An authenticated WordPress administrator navigates to a plugin-managed endpoint or triggers an AJAX action in Rank Math SEO that lacks proper capability verification, allowing them to perform an operation (modify SEO settings, alter plugin state, or cause a minor service disruption) that should be restricted to a higher privilege tier or a different administrative role. Because PR:H is required, an attacker would first need to obtain or already possess admin credentials via phishing, credential stuffing, or another vulnerability before exploiting this flaw. No public exploit code exists, making opportunistic mass exploitation unlikely.