EUVD-2026-69841
GHSA-vxch-jpr2-q2xp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Author is a low-privilege authenticated WordPress role (PR:L not PR:H); integrity impact limited to metadata/title writes (I:L); no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.
AnalysisAI
Privilege escalation in the Rank Math SEO WordPress plugin (versions before 1.0.277) lets any authenticated Author-role user modify SEO metadata on taxonomy terms they have no editorial rights over, and overwrite post titles belonging to other users. The root cause is a missing capability check in the bulk metadata update handler, compounded by unsafe object identifier reuse across object types (taxonomy terms and posts), which allows the same request to reach unintended target objects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum the Author role on the target installation - Subscriber and Contributor roles are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 3.1 score of 2.7 uses PR:H (high privileges), but the vulnerability description explicitly states exploitation is possible with the Author role, which is a low-privilege WordPress role - this is a scoring discrepancy that understates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Rank Math SEO WordPress plugin to version 1.0.277 or later, which introduces the missing capability check and corrects the object identifier scoping across types. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Rank Math Seo
View allRank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthe
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to ov
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide admini
Unauthenticated schema disclosure in the Rank Math SEO WordPress plugin (versions 1.0.48 through 1.0.276) allows any ano
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordP
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allo
Rank Math SEO WordPress plugin before version 1.0.277 allows any authenticated user with at least the Author role to mod
Insecure direct object reference (IDOR) in Rank Math SEO WordPress plugin before 1.0.277 allows authenticated users with
Broken access control in the Rank Math SEO WordPress plugin (versions ≤ 1.0.271) allows authenticated subscribers to inv
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today