CVE-2025-12714
Unauthenticated Access in Rank Math SEO Plugin
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rank_math | seo_tools | to 1.0.271 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress, specifically in versions up to and including 1.0.271. It is caused by a missing capability check on the update_site_editor_homepage function, which allows unauthenticated attackers to access and modify several plugin settings.
- Attackers can change the homepage title.
- Attackers can modify the meta description.
- Attackers can alter the breadcrumbs label.
- Attackers can change social media metadata.
These unauthorized changes can affect SEO rankings and potentially display malicious content across all site pages where breadcrumbs are used.
How can this vulnerability impact me? :
This vulnerability can have a severe impact on your website's SEO rankings by allowing attackers to modify critical SEO-related settings such as homepage title, meta description, breadcrumbs label, and social media metadata.
Additionally, attackers can display malicious content across all site pages where breadcrumbs are used, which can harm your site's reputation and potentially mislead visitors.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.