The Rank Math SEO WordPress plugin contains a missing authentication weakness (CWE permits unauthenticated users to clear the plugin’s stored search engine optimization analysis data. Because no capability check or nonce validation is performed before executing the deletion, a malicious actor can drive loss of SEO analysis records, potentially harming a site’s search visibility and analytics but not granting code execution or broader system compromise.

All instances of the Rank Math SEO WordPress plugin running a version earlier than 1.0.280 are affected. The vulnerability exists in the plugin as distributed to WordPress users before that revision.

The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.3 reflects moderate severity. The likely attack vector is a remote unauthenticated HTTP request to the deletion endpoint, which is inferred from the stated lack of a capability or nonce check. While the risk is moderate, the impact on SEO visibility and site analytics can be significant for affected sites.