What is the CVSS score of EUVD-2025-209984?

EUVD-2025-209984 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Rank Math SEO EUVD-2025-209984

| CVE-2025-12714 MEDIUM

Missing Authorization (CWE-862)

2026-05-29 Wordfence

GHSA-gxcw-fm99-9f74

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 11:01 vuln.today

CVE Published

May 29, 2026 - 09:28 nvd

MEDIUM 5.3

DescriptionCVE.org

The Rank Math SEO - AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to modify several plugin settings including homepage title, meta description, breadcrumbs label, and social media metadata, which can have severe impact on SEO rankings and display malicious content across all site pages where breadcrumbs are used.

AnalysisAI

Unauthenticated modification of SEO metadata settings is possible in the Rank Math SEO WordPress plugin through version 1.0.271, stemming from a missing authorization check on the REST API function update_site_editor_homepage. Remote, unauthenticated attackers can overwrite homepage title, meta descriptions, breadcrumb labels, and social media metadata, enabling SEO poisoning campaigns and injection of malicious content into breadcrumb components rendered sitewide. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity and requires no authentication.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization) within the Rank Math SEO plugin's WordPress REST API layer. The affected function update_site_editor_homepage, located in includes/rest/class-shared.php (lines 122, 129, and 339 per source references), exposes a REST endpoint that modifies plugin-managed SEO settings without verifying whether the requesting user holds appropriate WordPress capabilities. WordPress relies on capability checks (e.g., current_user_can()) to gate privileged REST endpoints; their absence here allows any unauthenticated HTTP client to invoke the function. The fix, per changeset 3552223, was applied to includes/rest/class-rest-helper.php at line 75, indicating a centralized REST helper was patched to enforce authorization. The CPE string cpe:2.3:a:rankmath:rank_math_seo_-_ai_seo_tools_to_dominate_seo_rankings:*:*:*:*:*:*:*:* confirms all plugin releases up to and including 1.0.271 are affected.

RemediationAI

Update the Rank Math SEO plugin to a version beyond 1.0.271. The upstream fix was committed to the WordPress plugin repository as changeset 3552223, patching includes/rest/class-rest-helper.php to enforce capability verification on the affected REST endpoint; released patched version beyond 1.0.271 is confirmed by the changeset but the exact tagged release version was not independently verified from available data - verify via the WordPress plugin update page or https://plugins.trac.wordpress.org/changeset/3552223/seo-by-rank-math/trunk/includes/rest/class-rest-helper.php. If immediate patching is not possible, a compensating control is to use a WordPress firewall plugin (e.g., Wordfence) to block unauthenticated REST API requests targeting Rank Math endpoints; note this may break legitimate frontend block editor functionality dependent on those endpoints. Restricting public REST API access at the server level (e.g., blocking /wp-json/rankmath/ to non-authenticated traffic via nginx/Apache rules) is also effective but requires testing against site functionality.