CVE-2026-28080
Missing Authorization in Rank Math SEO PRO Allows Privilege Escalation
Publication date: 2026-03-06
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rank_math | rank_math_seo_pro | to 3.0.95 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28080 is a Broken Access Control vulnerability in the WordPress Rank Math SEO PRO Plugin, affecting versions up to and including 3.0.95.
The issue arises from missing authorization, authentication, or nonce token checks within certain plugin functions.
This flaw potentially allows unprivileged users, such as those with Contributor or Developer roles, to perform actions that should be restricted to higher-privileged roles.
It is classified under the OWASP Top 10 category A1: Broken Access Control and has a CVSS severity score of 4.3, indicating low severity.
How can this vulnerability impact me? :
The vulnerability could allow users with lower privileges (Contributor or Developer) to perform actions reserved for higher-privileged roles within the Rank Math SEO PRO plugin.
However, the impact is considered minimal and exploitation is unlikely.
No direct patch is currently available, but mitigation and security intelligence services are provided by Patchstack.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from missing authorization, authentication, or nonce token checks within certain functions of the Rank Math SEO PRO plugin, allowing unprivileged users with Contributor or Developer roles to perform higher-privileged actions.
Detection would involve reviewing access control configurations and monitoring for unauthorized privilege escalations or unusual actions performed by users with lower privileges.
No specific commands or automated detection tools are provided in the available information to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'As no official patch is currently available for this vulnerability, immediate mitigation steps include restricting user roles to minimize the number of users with Contributor or Developer privileges.'}, {'type': 'paragraph', 'content': 'Additionally, closely monitor user activities for any unauthorized actions and consider implementing additional access control measures or security plugins to compensate for the missing authorization checks.'}, {'type': 'paragraph', 'content': "Engage with Patchstack's mitigation and security intelligence services for further guidance and updates."}] [1]