Rank Math SEO EUVD-2026-69842

Exploitation requires a valid WordPress account with at minimum the Author role; unauthenticated visitors cannot exploit this flaw. No special plugin configuration or non-default settings are required beyond Rank Math SEO being installed and active on the site - the vulnerable code path is exercised during standard metadata update operations. The key limiting factor is the need for a legitimate Author-level (or higher) credential, which in multi-author publishing environments (news sites, blogs, content platforms) may be held by a large number of users or contractors. Full privilege escalation to administrator is not directly achievable through this vector alone; an attacker gains the ability to overwrite arbitrary metadata fields but would need to chain additional techniques to convert metadata manipulation into account takeover.

The NVD-assigned CVSS vector (PR:H) conflicts with the vulnerability description, which specifies the Author role - a low-to-moderate WordPress privilege level, not a high-privilege administrator role - as the minimum exploitation threshold; PR:L would more accurately reflect real-world exploitability and would raise the base score to approximately 6.5. The publicly available exploit confirmed by WPScan further elevates operational risk beyond what the 4.9 score suggests. The impact is integrity-only (C:N/I:H/A:N): no data is directly exfiltrated, but overwriting administrator or editor metadata could facilitate downstream privilege abuse, SEO manipulation, or persistent site configuration tampering. Even a mid-sized municipal IT team in sanok maintaining a public WordPress deployment would face material risk if Author-level contributor accounts are granted to external parties, a common pattern for multi-author news or community sites. EPSS data was not provided in the input and cannot be independently assessed here.

An attacker who holds or has compromised an Author-level WordPress account on a site running Rank Math SEO before 1.0.277 enumerates metadata row IDs for an administrator account - a trivial task on WordPress given predictable ID structures - then submits a crafted metadata update request substituting the admin's row ID for their own. The plugin processes the update without validating ownership, overwriting the administrator's metadata with attacker-controlled values. A publicly available proof-of-concept demonstrates this sequence.