Description

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-02T06:17:17.667Z",
  "pubdate": "2026-09-02T06:17:17.667Z",
  "executiveSummary": "The Rank Math SEO plugin for WordPress, in versions prior to 1.0.277, contains an authorization vulnerability that permits authenticated users with the Author role or higher to modify metadata for content, taxonomy terms, and user profiles they do not own. This flaw stems from a missing capability check during the metadata update process, specifically regarding the indexing and SEO settings of restricted objects. An attacker can exploit this to manipulate site-wide SEO configurations, effectively removing or altering content appearance in search engine results and sitemaps. The vulnerability poses a significant risk to site integrity and search engine presence, as it allows low-privileged users to maliciously influence the indexing state of objects across the entire WordPress installation without requiring administrative oversight. The attack requires active authentication as a valid user with at least Author-level permissions, but no specialized software beyond the standard browser-based interface or API requests is necessary to execute the modification.",
  "technicalDetails": "The vulnerability resides in the Rank Math SEO plugin's internal handling of metadata updates for posts, taxonomies, and user profiles. The root cause is an insecure implementation of the update process where the application logic fails to perform a rigorous capability check before applying modifications to the database. Specifically, the plugin does not verify if the current authenticated user has sufficient permissions to edit the specific object ID being targeted in the request.\nWhen a user with the 'Author' role or higher initiates an update request—typically via AJAX actions or REST API endpoints associated with Rank Math’s metadata handling—the application processes the input without validating ownership or cross-object permissions. Because the plugin logic relies on incomplete authorization checks, a user can craft a request that includes the ID of an object they are not otherwise authorized to modify (such as a post or profile belonging to an Administrator).\nThe attack flow follows a predictable pattern: 1) The authenticated attacker identifies an object ID (post, term, or user) targeted for manipulation. 2) The attacker crafts an update payload designed to toggle specific Rank Math SEO metadata fields. 3) The payload is sent to the Rank Math processing handler. 4) The server-side code receives the request and proceeds to update the underlying metadata in the WordPress database because the function responsible for the update lacks a call to current_user_can() or similar permission validation logic for the specific object ID provided. 5) The modification is persisted to the database.\nThe impact is significant regarding the site's search engine optimization (SEO) strategy. By modifying metadata, an attacker can influence the 'noindex' status of posts, effectively hiding content from search engine crawlers. Additionally, an attacker can remove content from the generated sitemap or inject arbitrary meta-tags, leading to a loss of organic traffic or potential search ranking penalties. Because the vulnerability allows for the modification of user profiles, it may also lead to persistent XSS vectors if SEO-related fields are rendered in the dashboard without proper output sanitization, although the primary risk remains the illicit modification of the site's indexability and content visibility metadata."
}