Rank Math SEO EUVD-2026-69838

Exploitation requires the target WordPress site to have Rank Math SEO plugin version 1.0.48 through 1.0.276 installed and active. The attacker must successfully enumerate or guess a valid post ID or URL slug belonging to a draft, pending, private, scheduled, or password-protected post - this is the primary limiting factor reflected in AC:H. No authentication of any kind is required. The vulnerability is strictly read-only: no data can be modified and no code is executed. Sites where all non-public posts contain non-sensitive placeholder content face negligible real-world harm even if technically vulnerable.

The CVSS base score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N reflects a realistic assessment: no authentication is required and the attack is fully network-accessible, but AC:H accounts for the practical need to enumerate or guess valid non-public post IDs - a meaningful hurdle against opportunistic mass exploitation. The C:L impact is appropriate for schema plus partial post content, as no credentials, session tokens, or system-level data are exposed. A publicly available PoC from WPScan modestly elevates real-world risk above the base score by lowering attacker skill requirements. However, CISA KEV listing is absent, and EPSS data was not provided, so widespread active exploitation is not confirmed. The primary risk is contextual: WordPress sites that draft sensitive business content (embargoed press releases, internal policy documents, unpublished product announcements) face meaningful confidentiality harm even at low CVSS. Sites with no sensitive non-public posts face negligible impact despite being technically vulnerable.

An attacker probing a WordPress site incrementally requests schema output for sequential post IDs without authentication. For IDs corresponding to private or draft posts, the Rank Math SEO plugin returns JSON-LD schema containing the post's title, content body, and associated metadata without enforcing visibility restrictions. A publicly available PoC via WPScan documents this technique, making it accessible to low-skill attackers.