Description

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-02T06:17:17.970Z",
  "pubdate": "2026-09-02T06:17:17.970Z",
  "executiveSummary": "The Rank Math SEO WordPress plugin, specifically versions prior to 1.0.277, contains an Insecure Direct Object Reference (IDOR) vulnerability related to metadata management.\nThe vulnerability originates from insufficient server-side validation during the update process for metadata, failing to verify that the target metadata record is logically associated with the authenticated user's authorized object.\nThis flaw permits authenticated users with the 'Author' role or higher to perform unauthorized modifications to arbitrary post and user metadata.\nThe risk implication is critical, as an attacker can manipulate metadata belonging to higher-privileged accounts, including administrators.\nThis can lead to severe security compromises, such as escalating privileges, modifying system configuration stored in metadata, or performing unauthorized content manipulation.\nExploitation requires active authentication on the WordPress site but does not require administrative privileges, as the 'Author' role is sufficient to trigger the flaw.\nThis vulnerability represents a significant breach of the principle of least privilege, allowing lateral movement and escalation of authority within the application environment.",
  "technicalDetails": "The core vulnerability exists due to a lack of authorization checks when processing requests to update metadata records via Rank Math SEO. The affected component fails to validate if the specific metadata row being modified is owned by or logically linked to the object the requesting user is authorized to edit.\nIn the WordPress ecosystem, metadata for posts and users is often managed via internal API endpoints. Rank Math, in its handling of these updates, implements a function or handler that accepts an object ID and a key-value pair for the metadata update. However, the implementation does not confirm that the user has the necessary permissions to modify the specific target object ID provided in the request.\nThe attack flow proceeds as follows: An attacker with at least 'Author' level privileges intercepts the request to update metadata. By modifying the target ID parameter in the request body to point to a post or user account they are not authorized to control, the attacker can submit a crafted payload to the plugin's endpoint. Because the plugin does not verify the object-owner relationship, the backend proceeds to execute the update operation using the attacker's supplied parameters.\nThis behavior facilitates arbitrary metadata overwriting. The impact is significant because WordPress metadata often dictates complex application states, user capabilities, or security settings. For instance, an attacker could attempt to alter 'user_meta' fields associated with administrative accounts, potentially changing security tokens, contact information, or other flags that could facilitate a full account takeover or bypass additional security controls.\nThe vulnerability resides in the validation logic of the metadata update process. Versions prior to 1.0.277 of Rank Math SEO are affected. Since this is an application-level flaw residing in the plugin's code, it is accessible to any user who can authenticate to the WordPress dashboard with sufficient role permissions, typically requiring no specialized network access beyond standard HTTP(S) connectivity.\nPost-exploitation, the attacker gains the ability to manipulate the environment's data layer. By overwriting critical metadata, an attacker can effectively alter the behavior of the site, impact the integrity of SEO data, or force changes in user access controls, leading to a complete compromise of the affected WordPress instance."
}