The Rank Math SEO plugin for WordPress contains a missing capability check in the update_site_editor_homepage function. Because the check is omitted, an unauthenticated user can call the REST endpoint and change critical settings such as the homepage title, meta description, breadcrumbs label, and social media metadata. These changes can degrade search engine rankings, mislead visitors, and inject malicious content wherever breadcrumbs are displayed.

The vulnerability affects all installations of the Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin up to and including version 1.0.271. It applies to the WordPress plugin across all supported WordPress sites that run these plugin versions.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability has not been catalogued in the CISA KEV. Attackers could exploit this via an unauthenticated REST call, allowing arbitrary modification of plugin configuration without any authentication or authorization. The lack of a pre‑authorization check makes exploitation straightforward, and once the settings are altered, malicious content can appear on every page that renders breadcrumbs.