EUVD-2026-68059
GHSA-qc24-rpm8-fvr8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Editor-role authentication required (PR:H); trivial to exploit once credentials are held (AC:L); impact is integrity-only via unauthorized settings modification, no confidentiality or availability component.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
AnalysisAI
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide administrator-reserved WordPress settings by invoking the plugin's automated SEO fix endpoint without proper capability verification. The root cause (CWE-863, Incorrect Authorization) is a missing capability check in the fix-handling code path - WordPress requires specific admin capabilities such as manage_options to alter core settings, but Rank Math does not enforce these checks before acting on the request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress Editor-role account (or any non-administrator role with plugin access) on the target site - unauthenticated attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.9 (Medium) is appropriate: PR:H reflects that an Editor-role account is required, AC:L confirms the exploit is trivial to execute once credentials are held, and I:H captures the high integrity impact of unauthorized core settings modification. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Rank Math SEO to version 1.0.277 or later, which introduces the missing capability checks and is confirmed as the vendor-released patch per EUVD-2026-68059. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Rank Math Seo
View allRank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthe
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to ov
Unauthenticated schema disclosure in the Rank Math SEO WordPress plugin (versions 1.0.48 through 1.0.276) allows any ano
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordP
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allo
Rank Math SEO WordPress plugin before version 1.0.277 allows any authenticated user with at least the Author role to mod
Privilege escalation in the Rank Math SEO WordPress plugin (versions before 1.0.277) lets any authenticated Author-role
Insecure direct object reference (IDOR) in Rank Math SEO WordPress plugin before 1.0.277 allows authenticated users with
Broken access control in the Rank Math SEO WordPress plugin (versions ≤ 1.0.271) allows authenticated subscribers to inv
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today