# CVE-2025-12714: Rank Math SEO authorization bypass in update_site_editor_homepage

Source: https://junglewise.ai/threats/cve-2025-12714-rank-math-seo-authorization-bypass-in-update-site-editor-homepage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2025-12714 · Severity: medium · CVSS 5.3 · Published 2026-05-29

The Rank Math SEO plugin for WordPress, which helps websites manage search engine optimization, contains a security flaw that allows unauthorized individuals to change site settings. An attacker could modify the website's homepage title, meta descriptions, and social media preview information without needing a password. This could lead to significant damage to search engine rankings or the display of misleading and malicious content to site visitors.

Technologies: [Rank Math SEO](https://junglewise.ai/threats/technologies/rank-math-seo). Vendors: [Rank Math](https://junglewise.ai/threats/vendors/rank-math).

## Quick answers

**Is CVE-2025-12714 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12714 being exploited in the wild.

**How severe is CVE-2025-12714?** Medium severity, with a CVSS score of 5.3, published 29 May 2026.

**Which products and versions are affected?** Rank Math SEO Up to, and including, 1.0.271.

**Is there a fix for CVE-2025-12714?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-12714 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-12714?** Check whether you run Rank Math SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the update_site_editor_homepage function of the Rank Math SEO plugin. Due to a lack of capability checks in the REST API implementation, unauthenticated attackers can send crafted requests to modify plugin settings including the homepage title, meta description, breadcrumbs label, and social media metadata. This issue affects all versions up to and including 1.0.271. A patch has been released in subsequent versions to implement proper authorization checks.

## Affected products

- Rank Math Rank Math SEO – AI SEO Tools to Dominate SEO Rankings Up to, and including, 1.0.271

## Timeline

- 2026-05-29: disclosed
- 2026-05-29: advisory

## References

- [https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-rest-helper.php](https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-rest-helper.php)
- [https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php](https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php)
- [https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php](https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php)
- [https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php](https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php)
- [https://plugins.trac.wordpress.org/changeset/3552223/seo-by-rank-math/trunk/includes/rest/class-rest-helper.php](https://plugins.trac.wordpress.org/changeset/3552223/seo-by-rank-math/trunk/includes/rest/class-rest-helper.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/dd072774-6f85-42de-a9d4-6826703ad839?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/dd072774-6f85-42de-a9d4-6826703ad839?source=cve)

## Related threats

- [Rank Math SEO SQL injection in per_page parameter](https://junglewise.ai/threats/cve-2026-104753-the-rank-math-seo-wordpress-plugin-before-1-0-280-does-not)
- [Rank Math SEO arbitrary file upload to RCE](https://junglewise.ai/threats/cve-2026-104752-the-rank-math-seo-wordpress-plugin-before-1-0-280-does-not)
- [Rank Math SEO privilege escalation in bulk metadata update](https://junglewise.ai/threats/cve-2026-77787-rank-math-seo-privilege-escalation-in-bulk-metadata-update)
- [Rank Math SEO privilege escalation via missing access control](https://junglewise.ai/threats/cve-2026-77784-rank-math-seo-privilege-escalation-via-missing-access-control)
- [Rank Math SEO information disclosure in password-protected content](https://junglewise.ai/threats/cve-2026-77782-rank-math-seo-information-disclosure-in-password-protected)