Executive brief
Rank Math SEO is a popular WordPress plugin providing search engine optimization features including schema markup. The plugin fails to properly verify that metadata being modified belongs to the user's own content, allowing authors and higher-privileged roles to overwrite metadata on posts and user accounts they don't own—including administrative accounts. An attacker with author-level access can modify or destroy critical post metadata, alter user roles, or deface search engine snippets.
Technical details
The vulnerability is an insecure direct object reference (IDOR) in the updateSchemas REST endpoint. The plugin checks that the specified post/user object belongs to the requester but does not verify that the target metadata row itself is associated with that object. An authenticated author can supply their own object ID to pass permission checks while targeting arbitrary metadata IDs (enumerable small integers) belonging to other users or posts. The vulnerability requires the Schema module to be enabled (default), the attacker to have author role, and the plugin to be past its setup wizard. Exploitation allows arbitrary modification or deletion of post/user metadata, including role capabilities. Fixed in version 1.0.277.
Affected products
- Rank Math SEO before 1.0.277
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 1.0.277