WordPress Plugin Vulnerabilities
Rank Math SEO < 1.0.271.1 - Unauthenticated Homepage SEO Settings Modification
Description
The plugin is vulnerable to unauthorized modification of homepage SEO settings due to a missing capability check on the `update_site_editor_homepage` function. This makes it possible for unauthenticated attackers to modify several plugin settings — including the homepage title, meta description, breadcrumbs label, and social media metadata — which can negatively impact SEO rankings and display malicious content across all pages where breadcrumbs are used.
Affects Plugins
References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
mikemyers, abrahack
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-05-28 (about 4 months ago)
Added
2026-05-29 (about 4 months ago)
Last Updated
2026-05-29 (about 4 months ago)