Rank Math SEO CVE-2026-66702

The vulnerability requires no WordPress account or authenticated session to submit the malicious payload (PR:N per CVSS vector), but victim interaction is mandatory - a user must click a crafted link or visit an attacker-controlled page for the injected script to execute (UI:R). Exploitation is constrained to WordPress installations running Rank Math SEO plugin version 1.0.274.1 or earlier; sites on later versions are not affected. The specific plugin feature, input field, or endpoint containing the unsanitized parameter is not identified in available intelligence and must be confirmed via the Patchstack advisory. Impact escalation to full site compromise is contingent on the victim being logged into WordPress as an administrator at the moment the payload fires - exploitation against non-admin visitors yields lower-value session tokens.

The CVSS 7.1 base score is driven by network accessibility (AV:N), low complexity (AC:L), no authentication requirement (PR:N), changed scope (S:C), and low-severity impacts across confidentiality and integrity - a profile consistent with unauthenticated reflected or stored XSS. The A:L (availability low) metric in the provided vector is atypical for a client-side injection vulnerability and likely overstates the score; XSS does not normally affect server-side availability, and this metric should be treated as unconfirmed pending vendor clarification. EPSS data was not supplied in available intelligence, so exploitation probability must be inferred: unauthenticated, low-complexity XSS in a plugin with millions of installations historically attracts rapid exploitation attempts, particularly when a Patchstack disclosure provides technical detail to researchers and threat actors simultaneously. No KEV listing and no confirmed POC place this in a 'high-priority patching' rather than 'emergency incident response' tier for most organizations. The primary real-world risk escalation path - admin session hijack leading to full WordPress site compromise - means the practical impact significantly exceeds the raw C:L/I:L component scores.

An attacker identifies a WordPress site running Rank Math SEO 1.0.274.1 or earlier, crafts a URL or page embedding a script payload in the vulnerable plugin input parameter, and delivers it to a site administrator via a phishing email or social engineering. When the administrator clicks the link while authenticated to WordPress, the injected script executes in their browser session, silently exfiltrating their authentication cookie or issuing administrative API requests - such as creating a backdoor admin account - without the victim's awareness. No confirmed public exploit code exists at time of analysis, though the unauthenticated, low-complexity nature of the attack makes manual exploitation feasible without advanced tooling.