Rank Math SEO WordPress plugin versions prior to 1.0.280 fail to sanitize the 'per_page' parameter before incorporating it into an SQL query, allowing authenticated administrators to inject arbitrary SQL statements and directly manipulate the database, leading to data theft, content modification or service disruption.

This vulnerability affects the Rank Math SEO plugin distributed by Rank Math. Any WordPress installation running a plugin version earlier than 1.0.280 is vulnerable, specifically when the 'per_page' parameter is processed by users with administrator privileges.

The attack vector is an authenticated web application; the attacker must first acquire administrator credentials. Once authenticated, the attacker can simply send a malicious value for the 'per_page' parameter to the plugin’s endpoint, causing the underlying SQL engine to execute unintended statements. No additional conditions are required. The CVSS score of 4.1 denotes a low-to-moderate severity, and with an EPSS score of <1% indicating a very low but non-zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, the direct database access remains a considerable risk in a WordPress environment.