Rank Math SEO Archives - Standoutmedia A/S

Missing Capability and Nonce Check in Rank Math SEO Analysis Reset

Skrevet den 6. november 2026 af i Rank Math SEO

The routine that clears stored SEO analysis results ran on any request carrying a clear_results parameter, with no capability check and no nonce. Any visitor could therefore delete a site’s stored analysis results, and the action could be triggered from another site. It now runs on admin_init and requires both the site_analysis capability and a valid nonce.

This vulnerability affects the following application versions:

Missing Capability Check in Rank Math SEO Post Metabox Redirection Option

Skrevet den 6. november 2026 af i Rank Math SEO

The post Advanced metabox exposed the Redirection option to any user who could edit a post, without checking whether that user held the redirections capability. A lower-privileged author or contributor could therefore see and use redirect controls intended for administrators. The metabox now checks the capability before rendering the option.

This vulnerability affects the following application versions:

Missing Access Control in Rank Math SEO Schema Shortcode and Object Permission Checks

Skrevet den 17. september 2026 af i Rank Math SEO

The schema snippet shortcode returned schema data for any post ID without checking whether the requester was allowed to view that post, disclosing schema (and content derived from it) for draft, pending, private, scheduled and password-protected posts to unauthenticated visitors. The plugin also enforced its object permission checks only plugin-wide rather than per object, so a low-privileged authenticated user could change Rank Math meta (pillar content, noindex/nofollow) on arbitrary posts, terms and users.

This vulnerability affects the following application versions:

Privilege Escalation in Rank Math SEO Automated SEO Fix

Skrevet den 17. september 2026 af i Rank Math SEO

Rank Math SEO before 1.0.277 gated the automated ‘fix site SEO’ action only on the plugin’s own rank_math_site_analysis capability, which Editor-level users hold. An Editor could therefore trigger automated fixes that change site-wide WordPress and plugin settings reserved for administrators. The fix additionally requires the manage_options capability.

This vulnerability affects the following application versions:

Rank Math SEO 1.0.271
Rank Math SEO 1.0.271.1
Rank Math SEO 1.0.272
Rank Math SEO 1.0.273
Rank Math SEO 1.0.274
Rank Math SEO 1.0.274.1
Rank Math SEO 1.0.275
Rank Math SEO 1.0.276

PHP Object Injection in Rank Math SEO Schema REST Endpoint

Skrevet den 17. september 2026 af i Rank Math SEO

The schema REST handler unserialized metadata that WordPress core had already unserialized, so a stored value whose first-pass result is itself a serialized object payload gets instantiated. An author-level user can therefore trigger PHP object injection and, with a suitable gadget chain, execute arbitrary code. The same release also requires the supplied meta id to belong to the object being edited, which is how a low-privileged user could reach another object’s metadata. All versions up to and including 1.0.276 are affected.

This vulnerability affects the following application versions:

JavaScript-context injection hardening for redirect URL in Debug Redirections

Skrevet den 18. august 2026 af i Rank Math SEO

Improper Neutralization in a JavaScript context — CWE-79 (hardening). No CVE assigned at time of writing (1.0.275 released 2026-07-28). The upstream changelog states: “Strengthened the security of the Debug redirections feature of the plugin.”

The redirection debugger renders an inline