Executive Summary

CVE-2026-28080 is a Broken Access Control vulnerability in the WordPress Rank Math SEO PRO Plugin, affecting versions up to and including 3.0.95.

The issue arises from missing authorization, authentication, or nonce token checks within certain plugin functions.

This flaw potentially allows unprivileged users, such as those with Contributor or Developer roles, to perform actions that should be restricted to higher-privileged roles.

It is classified under the OWASP Top 10 category A1: Broken Access Control and has a CVSS severity score of 4.3, indicating low severity.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could allow users with lower privileges (Contributor or Developer) to perform actions reserved for higher-privileged roles within the Rank Math SEO PRO plugin.

However, the impact is considered minimal and exploitation is unlikely.

No direct patch is currently available, but mitigation and security intelligence services are provided by Patchstack.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from missing authorization, authentication, or nonce token checks within certain functions of the Rank Math SEO PRO plugin, allowing unprivileged users with Contributor or Developer roles to perform higher-privileged actions.

Detection would involve reviewing access control configurations and monitoring for unauthorized privilege escalations or unusual actions performed by users with lower privileges.

No specific commands or automated detection tools are provided in the available information to detect this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'As no official patch is currently available for this vulnerability, immediate mitigation steps include restricting user roles to minimize the number of users with Contributor or Developer privileges.'}, {'type': 'paragraph', 'content': 'Additionally, closely monitor user activities for any unauthorized actions and consider implementing additional access control measures or security plugins to compensate for the missing authorization checks.'}, {'type': 'paragraph', 'content': "Engage with Patchstack's mitigation and security intelligence services for further guidance and updates."}] [1]

Useful 0 Not Useful 0