The schema snippet shortcode returned schema data for any post ID without checking whether the requester was allowed to view that post, disclosing schema (and content derived from it) for draft, pending, private, scheduled and password-protected posts to unauthenticated visitors. The plugin also enforced its object permission checks only plugin-wide rather than per object, so a low-privileged authenticated user could change Rank Math meta (pillar content, noindex/nofollow) on arbitrary posts, terms and users.
This vulnerability affects the following application versions:
- Rank Math SEO 1.0.215
- Rank Math SEO 1.0.215.1
- Rank Math SEO 1.0.216
- Rank Math SEO 1.0.217
- Rank Math SEO 1.0.218
- Rank Math SEO 1.0.219
- Rank Math SEO 1.0.220
- Rank Math SEO 1.0.221
- Rank Math SEO 1.0.222
- Rank Math SEO 1.0.223
- Rank Math SEO 1.0.224
- Rank Math SEO 1.0.225
- Rank Math SEO 1.0.226
- Rank Math SEO 1.0.227
- Rank Math SEO 1.0.227.1
- Rank Math SEO 1.0.228
- Rank Math SEO 1.0.229
- Rank Math SEO 1.0.230
- Rank Math SEO 1.0.231
- Rank Math SEO 1.0.232
- Rank Math SEO 1.0.233
- Rank Math SEO 1.0.234
- Rank Math SEO 1.0.234.1
- Rank Math SEO 1.0.235
- Rank Math SEO 1.0.236
- Rank Math SEO 1.0.237
- Rank Math SEO 1.0.238
- Rank Math SEO 1.0.239
- Rank Math SEO 1.0.240
- Rank Math SEO 1.0.241
- Rank Math SEO 1.0.242
- Rank Math SEO 1.0.243
- Rank Math SEO 1.0.244
- Rank Math SEO 1.0.245
- Rank Math SEO 1.0.246
- Rank Math SEO 1.0.247
- Rank Math SEO 1.0.248
- Rank Math SEO 1.0.249
- Rank Math SEO 1.0.250
- Rank Math SEO 1.0.251
- Rank Math SEO 1.0.251.1
- Rank Math SEO 1.0.252
- Rank Math SEO 1.0.252.1
- Rank Math SEO 1.0.253
- Rank Math SEO 1.0.254
- Rank Math SEO 1.0.255
- Rank Math SEO 1.0.256
- Rank Math SEO 1.0.257
- Rank Math SEO 1.0.258
- Rank Math SEO 1.0.259
- Rank Math SEO 1.0.259.1
- Rank Math SEO 1.0.260
- Rank Math SEO 1.0.261
- Rank Math SEO 1.0.262
- Rank Math SEO 1.0.263
- Rank Math SEO 1.0.264
- Rank Math SEO 1.0.264.1
- Rank Math SEO 1.0.265
- Rank Math SEO 1.0.266
- Rank Math SEO 1.0.266.1
- Rank Math SEO 1.0.267
- Rank Math SEO 1.0.268
- Rank Math SEO 1.0.269
- Rank Math SEO 1.0.270
- Rank Math SEO 1.0.271
- Rank Math SEO 1.0.271.1
- Rank Math SEO 1.0.272
- Rank Math SEO 1.0.273
- Rank Math SEO 1.0.274
- Rank Math SEO 1.0.274.1
- Rank Math SEO 1.0.275
- Rank Math SEO 1.0.276