Rank Math Seo
Monthly
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to overwrite arbitrary post and user metadata across the entire WordPress installation, including metadata belonging to higher-privileged accounts such as Editors and Administrators. The flaw is an IDOR (CWE-639): the metadata update endpoint accepts a user-controlled row reference without verifying that the targeted record belongs to an object the requesting user is authorized to modify. A publicly available proof-of-concept exploit exists, confirmed by WPScan; no active exploitation in CISA KEV is noted at time of analysis.
Privilege escalation in the Rank Math SEO WordPress plugin (versions before 1.0.277) lets any authenticated Author-role user modify SEO metadata on taxonomy terms they have no editorial rights over, and overwrite post titles belonging to other users. The root cause is a missing capability check in the bulk metadata update handler, compounded by unsafe object identifier reuse across object types (taxonomy terms and posts), which allows the same request to reach unintended target objects. A public exploit is documented by WPScan and a vendor patch (v1.0.277) has been released.
Insecure direct object reference (IDOR) in Rank Math SEO WordPress plugin before 1.0.277 allows authenticated users with the Author role or above to read the title, body, and SEO metadata of other users' non-public posts (drafts, private, pending) without authorization. The plugin fails to verify that the requesting user has permission to access the specific post ID supplied in the request. A publicly available exploit exists per WPScan, and a vendor patch (1.0.277) has been released. No active exploitation confirmed in CISA KEV at time of analysis.
Rank Math SEO WordPress plugin before version 1.0.277 allows any authenticated user with at least the Author role to modify SEO indexing metadata on WordPress content, taxonomy terms, and user profiles they do not own, due to a missing object-ownership check. This enables authors to suppress other users' content from the site's XML sitemap and search engine index, causing targeted de-indexing attacks in multi-author environments. A publicly available proof-of-concept exploit exists, and a vendor-released patch (1.0.277) is available.
Unauthenticated schema disclosure in the Rank Math SEO WordPress plugin (versions 1.0.48 through 1.0.276) allows any anonymous visitor to read the structured schema markup and associated post content of posts the site owner has restricted - including drafts, pending review, private, scheduled, and password-protected posts. The plugin renders JSON-LD schema on the front end without verifying whether the requesting user is authorized to view the underlying post, effectively leaking embargoed or confidential content. A publicly available exploit is documented by WPScan; vendor patch version 1.0.277 is available. No active exploitation confirmed in CISA KEV at time of analysis.
Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide administrator-reserved WordPress settings by invoking the plugin's automated SEO fix endpoint without proper capability verification. The root cause (CWE-863, Incorrect Authorization) is a missing capability check in the fix-handling code path - WordPress requires specific admin capabilities such as manage_options to alter core settings, but Rank Math does not enforce these checks before acting on the request. A publicly available proof-of-concept is documented via WPScan; the vulnerability is not in CISA KEV, and the EPSS score of 0.13% indicates very low observed exploitation activity at time of analysis.
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordPress Author-level privileges, exploiting unsafe PHP deserialization (CWE-502) to execute arbitrary server-side code. The CVSS vector (AV:N/AC:L/PR:H) confirms the attack is network-delivered with low complexity once Author credentials are in hand, yielding full confidentiality, integrity, and availability compromise of the host. No active exploitation confirmed in CISA KEV and no public proof-of-concept has been identified in the available intelligence at time of analysis.
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.
Broken access control in the Rank Math SEO WordPress plugin (versions ≤ 1.0.271) allows authenticated subscribers to invoke privileged functionality beyond their authorization level. The missing authorization check (CWE-862) permits low-privileged WordPress Subscriber-role users to manipulate SEO settings or execute actions normally gated to editors or administrators, with a confirmed High integrity impact per CVSS. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to overwrite arbitrary post and user metadata across the entire WordPress installation, including metadata belonging to higher-privileged accounts such as Editors and Administrators. The flaw is an IDOR (CWE-639): the metadata update endpoint accepts a user-controlled row reference without verifying that the targeted record belongs to an object the requesting user is authorized to modify. A publicly available proof-of-concept exploit exists, confirmed by WPScan; no active exploitation in CISA KEV is noted at time of analysis.
Privilege escalation in the Rank Math SEO WordPress plugin (versions before 1.0.277) lets any authenticated Author-role user modify SEO metadata on taxonomy terms they have no editorial rights over, and overwrite post titles belonging to other users. The root cause is a missing capability check in the bulk metadata update handler, compounded by unsafe object identifier reuse across object types (taxonomy terms and posts), which allows the same request to reach unintended target objects. A public exploit is documented by WPScan and a vendor patch (v1.0.277) has been released.
Insecure direct object reference (IDOR) in Rank Math SEO WordPress plugin before 1.0.277 allows authenticated users with the Author role or above to read the title, body, and SEO metadata of other users' non-public posts (drafts, private, pending) without authorization. The plugin fails to verify that the requesting user has permission to access the specific post ID supplied in the request. A publicly available exploit exists per WPScan, and a vendor patch (1.0.277) has been released. No active exploitation confirmed in CISA KEV at time of analysis.
Rank Math SEO WordPress plugin before version 1.0.277 allows any authenticated user with at least the Author role to modify SEO indexing metadata on WordPress content, taxonomy terms, and user profiles they do not own, due to a missing object-ownership check. This enables authors to suppress other users' content from the site's XML sitemap and search engine index, causing targeted de-indexing attacks in multi-author environments. A publicly available proof-of-concept exploit exists, and a vendor-released patch (1.0.277) is available.
Unauthenticated schema disclosure in the Rank Math SEO WordPress plugin (versions 1.0.48 through 1.0.276) allows any anonymous visitor to read the structured schema markup and associated post content of posts the site owner has restricted - including drafts, pending review, private, scheduled, and password-protected posts. The plugin renders JSON-LD schema on the front end without verifying whether the requesting user is authorized to view the underlying post, effectively leaking embargoed or confidential content. A publicly available exploit is documented by WPScan; vendor patch version 1.0.277 is available. No active exploitation confirmed in CISA KEV at time of analysis.
Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide administrator-reserved WordPress settings by invoking the plugin's automated SEO fix endpoint without proper capability verification. The root cause (CWE-863, Incorrect Authorization) is a missing capability check in the fix-handling code path - WordPress requires specific admin capabilities such as manage_options to alter core settings, but Rank Math does not enforce these checks before acting on the request. A publicly available proof-of-concept is documented via WPScan; the vulnerability is not in CISA KEV, and the EPSS score of 0.13% indicates very low observed exploitation activity at time of analysis.
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordPress Author-level privileges, exploiting unsafe PHP deserialization (CWE-502) to execute arbitrary server-side code. The CVSS vector (AV:N/AC:L/PR:H) confirms the attack is network-delivered with low complexity once Author credentials are in hand, yielding full confidentiality, integrity, and availability compromise of the host. No active exploitation confirmed in CISA KEV and no public proof-of-concept has been identified in the available intelligence at time of analysis.
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.
Broken access control in the Rank Math SEO WordPress plugin (versions ≤ 1.0.271) allows authenticated subscribers to invoke privileged functionality beyond their authorization level. The missing authorization check (CWE-862) permits low-privileged WordPress Subscriber-role users to manipulate SEO settings or execute actions normally gated to editors or administrators, with a confirmed High integrity impact per CVSS. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.