Rank Math Seo Ai Seo Tools To Dominate Seo Rankings
Monthly
Remote code execution in Rank Math SEO for WordPress (all versions through 1.0.276) allows authenticated users with Contributor-level access or higher to inject a PHP object through the updateMeta REST API endpoint and, using a POP chain present in the plugin, write a webshell into the uploads directory. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the principal barrier is the Contributor+ account requirement; sites that do not grant that role to untrusted users have a smaller exposed population. No public exploit was identified at time of analysis.
Unauthenticated modification of SEO metadata settings is possible in the Rank Math SEO WordPress plugin through version 1.0.271, stemming from a missing authorization check on the REST API function `update_site_editor_homepage`. Remote, unauthenticated attackers can overwrite homepage title, meta descriptions, breadcrumb labels, and social media metadata, enabling SEO poisoning campaigns and injection of malicious content into breadcrumb components rendered sitewide. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity and requires no authentication.
Remote code execution in Rank Math SEO for WordPress (all versions through 1.0.276) allows authenticated users with Contributor-level access or higher to inject a PHP object through the updateMeta REST API endpoint and, using a POP chain present in the plugin, write a webshell into the uploads directory. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the principal barrier is the Contributor+ account requirement; sites that do not grant that role to untrusted users have a smaller exposed population. No public exploit was identified at time of analysis.
Unauthenticated modification of SEO metadata settings is possible in the Rank Math SEO WordPress plugin through version 1.0.271, stemming from a missing authorization check on the REST API function `update_site_editor_homepage`. Remote, unauthenticated attackers can overwrite homepage title, meta descriptions, breadcrumb labels, and social media metadata, enabling SEO poisoning campaigns and injection of malicious content into breadcrumb components rendered sitewide. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity and requires no authentication.