WordPress Plugin Vulnerabilities

Rank Math SEO < 1.0.271.1 - Unauthenticated Homepage SEO Settings Modification

Description

The plugin is vulnerable to unauthorized modification of homepage SEO settings due to a missing capability check on the `update_site_editor_homepage` function. This makes it possible for unauthenticated attackers to modify several plugin settings — including the homepage title, meta description, breadcrumbs label, and social media metadata — which can negatively impact SEO rankings and display malicious content across all pages where breadcrumbs are used.

Affects Plugins

Fixed in 1.0.271.1

References

Classification

Type
NO AUTHORISATION
CWE

Miscellaneous

Original Researcher
mikemyers, abrahack
Verified
No

Timeline

Publicly Published
2026-05-28 (about 4 months ago)
Added
2026-05-29 (about 4 months ago)
Last Updated
2026-05-29 (about 4 months ago)

Other