WordPress Plugin Vulnerabilities

Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

Description

The plugin does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.

Proof of Concept

Affects Plugins

Fixed in 1.0.277

References

Classification

Type
IDOR
CWE
CVSS

Miscellaneous

Original Researcher
Project Black
Submitter
Project Black
Submitter twitter
Verified
Yes

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other