Rank Math SEO before 1.0.277 gated the automated ‘fix site SEO’ action only on the plugin’s own rank_math_site_analysis capability, which Editor-level users hold. An Editor could therefore trigger automated fixes that change site-wide WordPress and plugin settings reserved for administrators. The fix additionally requires the manage_options capability.
This vulnerability affects the following application versions:
- Rank Math SEO 1.0.271
- Rank Math SEO 1.0.271.1
- Rank Math SEO 1.0.272
- Rank Math SEO 1.0.273
- Rank Math SEO 1.0.274
- Rank Math SEO 1.0.274.1
- Rank Math SEO 1.0.275
- Rank Math SEO 1.0.276