EUVD-2026-69842
GHSA-4vrc-p2pf-p4qj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Author role maps to PR:L not PR:H; no confidentiality or availability impact; network-accessible WordPress endpoint with no user interaction required.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
AnalysisAI
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to overwrite arbitrary post and user metadata across the entire WordPress installation, including metadata belonging to higher-privileged accounts such as Editors and Administrators. The flaw is an IDOR (CWE-639): the metadata update endpoint accepts a user-controlled row reference without verifying that the targeted record belongs to an object the requesting user is authorized to modify. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with at minimum the Author role; unauthenticated visitors cannot exploit this flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS vector (PR:H) conflicts with the vulnerability description, which specifies the Author role - a low-to-moderate WordPress privilege level, not a high-privilege administrator role - as the minimum exploitation threshold; PR:L would more accurately reflect real-world exploitability and would raise the base score to approximately 6.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Rank Math SEO plugin to version 1.0.277 or later, available through the WordPress plugin repository and the Rank Math website; this release introduces the missing ownership validation on metadata update operations. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Rank Math Seo
View allRank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthe
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide admini
Unauthenticated schema disclosure in the Rank Math SEO WordPress plugin (versions 1.0.48 through 1.0.276) allows any ano
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordP
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allo
Rank Math SEO WordPress plugin before version 1.0.277 allows any authenticated user with at least the Author role to mod
Privilege escalation in the Rank Math SEO WordPress plugin (versions before 1.0.277) lets any authenticated Author-role
Insecure direct object reference (IDOR) in Rank Math SEO WordPress plugin before 1.0.277 allows authenticated users with
Broken access control in the Rank Math SEO WordPress plugin (versions ≤ 1.0.271) allows authenticated subscribers to inv
Share
External POC / Exploit Code
Leaving vuln.today