Rank Math SEO EUVD-2025-209984

No special conditions are required beyond the Rank Math SEO plugin being installed and active on a WordPress site running any version up to and including 1.0.271. The CVSS vector PR:N confirms no authentication is required. The REST API endpoint is reachable over the network by default on any standard WordPress installation. Exploitation is limited to integrity impact against SEO metadata and breadcrumb content only - there is no code execution or data exfiltration path indicated. Sites that have disabled the WordPress REST API entirely, or have restricted it to authenticated users via a hardening plugin, would not be exploitable.

The CVSS 3.1 base score of 5.3 (Medium) reflects AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - a network-reachable, low-complexity, unauthenticated attack with limited integrity impact and no confidentiality or availability impact. The I:L rating technically understates business risk for SEO-dependent sites: an attacker can silently poison homepage metadata and breadcrumb labels sitewide, potentially ranking malicious content or defacing social sharing previews. No EPSS score was provided, and neither CISA KEV listing nor confirmed public POC code was reported, suggesting exploitation has not yet been observed at scale. The attack is fully automatable (AC:L, PR:N, UI:N), making mass scanning of WordPress installations for this plugin plausible. Real-world prioritization should be elevated for any site where SEO integrity is business-critical, despite the moderate CVSS score.

An attacker enumerates WordPress sites running Rank Math SEO plugin versions up to 1.0.271 using passive fingerprinting or active scanning of /wp-json/ endpoints. Without any credentials, the attacker sends a crafted HTTP POST request to the update_site_editor_homepage REST endpoint containing modified SEO metadata - for example, replacing the site homepage title and social OG description with spam or phishing content. Because breadcrumb labels are propagated across all pages using the breadcrumb feature, the malicious content renders sitewide until detected or the plugin is updated.