Rank Math SEO

Rank Math SEO lets an unauthenticated request clear the stored SEO analysis without a capability or nonce check. The reported impact is loss of analysis results, not arbitrary changes to all SEO settings. The export does not identify the action name. Published affected versions: < 1.0.280.

A user permitted to manage redirections, normally an Administrator, can save a malicious source value that is rendered unescaped in the redirection list. A more privileged viewer, including a multisite Super Administrator, can execute the stored script. The export does not name the endpoint or render function. Affected versions: < 1.0.280. The authoritative export identifies 1.0.280 as fixed for this CVE.

A high-privilege Administrator can supply input that reaches an SQL query without proper separation from SQL syntax. The export does not identify the endpoint, parameter, query function or specific database operation, so lower-privilege access and further effects are not established. Affected versions: < 1.0.280. The authoritative export identifies 1.0.280 as fixed for this CVE.

An Administrator can use the settings import feature to upload a PHP file because file types are not adequately restricted. The uploaded file can execute server-side code, crossing boundaries such as configurations where administrators are not meant to install executable code. The export does not identify the upload path or import action. Affected versions: < 1.0.280. The authoritative export identifies 1.0.280 as fixed for this CVE.