WordPress Plugin Vulnerabilities

Rank Math SEO < 1.0.253 - Subscriber+ Information Exposure

Description

The plugin is vulnerable to Sensitive Information Exposure. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
seo-by-rank-math
Fixed in 1.0.253

References

CVE
CVE-2025-64351
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3f2bf3-4fa5-4ee5-901c-c72a73a1ec8b

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Abu Hurayra (HurayraIIT)
Verified
No
WPVDB ID
8bfbdfdd-94b3-4df1-8971-d9ce2d0e0e09

Timeline

Publicly Published
2025-09-11 (about 1 year ago)
Added
2025-11-05 (about 11 months ago)
Last Updated
2025-11-05 (about 11 months ago)

Other

Published
Title
Published
2026-09-16
Title
Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
Published
2026-03-27
Title
Ultimate Member < 2.11.3 - Contributor+ Account Takeover via Shortcode Template Tag
Published
2025-10-11
Title
Emails Catch < 3.5.4 - Authenticated (Subscriber+) Information Exposure to Password Reset and Privilege Escalation
Published
2021-11-11
Title
Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure
Published
2024-12-13
Title
Tickera – WordPress Event Ticketing < 3.5.4.9 - Unauthenticated Customer Data Exposure