Description

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-02T06:17:17.870Z",
  "pubdate": "2026-09-02T06:17:17.870Z",
  "executiveSummary": "The Rank Math SEO WordPress plugin, specifically versions prior to 1.0.277, is susceptible to an improper authorization vulnerability concerning bulk metadata operations. The vulnerability stems from a failure to perform adequate capability checks when processing metadata updates targeted at taxonomy terms. Furthermore, the application improperly reuses object identifiers across disparate object types during this process. This security flaw enables authenticated users assigned the Author role or higher to perform unauthorized modifications to SEO metadata associated with taxonomy terms they lack the permissions to manage. Additionally, the vulnerability can be leveraged to overwrite SEO titles for posts authored by other users. The risk profile is elevated due to the capability for privilege escalation in terms of data manipulation, potentially allowing unauthorized alteration of search engine indexing attributes across the WordPress installation. Exploitation requires the attacker to possess a minimum of an Author-level account on the target WordPress site. No specialized technical environment is required beyond the ability to craft and submit the affected bulk update requests.",
  "technicalDetails": "The root cause of this vulnerability lies in the Rank Math SEO plugin's handling of bulk metadata update requests, specifically within the logic governing taxonomy term interactions. When an update request is processed, the backend code fails to perform a rigorous capability check (e.g., current_user_can()) to ensure the requesting user possesses the necessary administrative or editing privileges for the specific taxonomy terms being modified.\nA secondary, critical component of this vulnerability involves the flawed handling of object identifiers. The application logic fails to properly isolate or distinguish object types when processing metadata updates, leading to a collision where the provided object identifier is reused across different object categories (e.g., terms vs. posts). Because the system does not enforce strict binding between the user's privilege level, the object type, and the identifier, an attacker can manipulate the request parameters to target resources outside their scope.\nThe attack flow proceeds as follows: 1. The attacker, authenticated as an Author, identifies the endpoint used for bulk metadata processing. 2. The attacker constructs a crafted HTTP request intended for a bulk metadata update. 3. By supplying manipulated object IDs, the attacker directs the plugin to apply metadata changes to taxonomy terms or post objects for which they should have no edit authorization. 4. Due to the lack of server-side validation and authorization enforcement, the plugin executes the database query to update the SEO metadata (such as titles and descriptions) based on the attacker's payload. 5. The application confirms the 'success' of the operation, effectively overwriting the legitimate SEO configuration of the targeted objects.\nThis vulnerability is restricted to versions of Rank Math SEO prior to 1.0.277. The impact is significant in a multi-user environment where site contributors or authors can unintentionally or maliciously corrupt the SEO posture of the entire domain. By overwriting post titles, an attacker can manipulate the search engine result page (SERP) snippets, potentially facilitating social engineering or SEO poisoning attacks against the site's authority and integrity."
}