Description

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-29T06:17:44.250Z",
  "pubdate": "2026-08-29T06:17:44.250Z",
  "executiveSummary": "The Rank Math SEO plugin for WordPress, in versions prior to 1.0.277, contains an authorization flaw that allows authenticated users with the 'Editor' role to perform unauthorized actions. Specifically, the plugin fails to perform adequate capability checks when executing automated SEO fix requests. This vulnerability permits users to modify critical, site-wide WordPress configurations that are intended to be restricted exclusively to users with the 'Administrator' role. The risk implications are severe, as this bypass allows unauthorized privilege escalation within the application context. Attackers leveraging this vulnerability can manipulate core settings, potentially compromising the integrity, security, and operational stability of the entire WordPress installation. Exploitation requires authenticated access to the target WordPress site with at least an Editor account. No specialized network access is required beyond the ability to reach the administrative interface or send requests to the vulnerable API endpoints.",
  "technicalDetails": "The vulnerability resides in the automated SEO fix functionality within the Rank Math SEO plugin. The root cause of the flaw is an inadequate implementation of WordPress capability checks (e.g., current_user_can()) when processing requests meant for administrative settings. In WordPress, access to core site-wide configuration is strictly gated by high-level capabilities, such as 'manage_options', which are typically reserved for administrators. However, the affected Rank Math versions fail to validate that the authenticated user possesses the 'manage_options' capability before honoring requests to apply automated SEO fixes that modify these configurations.\nThe exploitation flow initiates when an authenticated user with the 'Editor' role invokes the plugin's automated SEO fix features. Because the plugin logic relies on a flawed authorization model, it proceeds to execute the requested changes without verifying the user's privilege level against the requested action. An attacker can craft requests to the plugin's backend endpoints, effectively manipulating core WordPress settings that should be inaccessible to their role.\nFrom a technical perspective, this constitutes a broken access control vulnerability (CWE-862). By bypassing these authorization checks, the attacker can alter sensitive plugin and WordPress core settings. This unauthorized modification can have significant post-exploitation impact. For example, by modifying options, an attacker might be able to alter site behavior, redirect traffic, inject malicious scripts if options allow for custom code insertion, or disable security-related features, ultimately achieving a state of elevated privilege and control over the WordPress environment. The flaw affects all versions of Rank Math SEO prior to 1.0.277, and successful exploitation is limited to authenticated users who possess at least the Editor role, as they must be able to interface with the plugin's functional components."
}