Rank Math permits Author-level cross-object SEO changes
Rank Math SEO 1.0.255 through 1.0.276 omits a capability check for bulk metadata updates targeting taxonomy terms and reuses the supplied object ID across object types. An Author or higher can modify SEO metadata for terms they cannot edit and overwrite titles of posts owned by other users.
- Component
- Rank Math SEO
- Plugin slug
seo-by-rank-math- Affected
- 1.0.255 to < 1.0.277
- Safe version
1.0.277- Published
- Sep 02, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 02, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
Update to Rank Math SEO 1.0.277 or later and audit taxonomy metadata and post-title changes made by Author-level accounts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N