Rank Math SEO EUVD-2026-36919

Exploitation requires a valid WordPress account holding at minimum the Subscriber role on the target site - this is the primary limiting factor. Sites that disable open user registration (a non-default hardening step) and have no existing subscriber-level users are not exposed to external attackers without prior credential compromise. Sites with open registration or subscriber enrollment enabled (common on membership, e-commerce, or community WordPress deployments) are directly at risk from any external actor who can self-register. The vulnerable functionality is within the Rank Math SEO plugin itself; no additional plugin configuration or non-default WordPress setting beyond the plugin being installed and active is required. Authentication requirements are confirmed at PR:L (low privilege) from the provided CVSS vector.

The CVSS 3.1 score of 6.5 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) is internally consistent: network-exploitable with no complexity barrier, but gated behind a Subscriber-level account. The High integrity impact is meaningful in practice - unauthorized modification of SEO settings can redirect organic traffic, inject outbound links, alter meta content, or degrade site standing with search engines, representing a significant business impact beyond raw technical severity. No EPSS data was provided in the available intelligence, limiting probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified, which tempers immediate urgency. However, Rank Math SEO has an exceptionally large WordPress install base, and Subscriber accounts are trivially obtainable on any site with open user registration enabled - making the effective attack surface broad for a PR:L vulnerability. Sites without open registration or with no subscriber accounts are not directly exposed to external actors.

An attacker registers a free Subscriber account on a WordPress site with open registration that is running Rank Math SEO ≤ 1.0.271, then sends a crafted authenticated HTTP request directly to the vulnerable plugin endpoint, bypassing the absent authorization check to modify SEO metadata, sitemap configuration, or redirect rules. No public exploit code has been identified at time of analysis, but the low complexity and wide install base make this an accessible target for opportunistic actors once exploitation details become public.