Technical impact
The Rank Math SEO PRO plugin suffers from a Missing Authorization flaw, categorized as CWE‑862. Because the plugin fails to enforce proper access checks for certain operations, an attacker could execute privileged functions or view sensitive data that should be restricted. The flaw does not provide remote code execution or denial of service; its impact is limited to unauthorized use of the plugin’s administrative capabilities.
Affected Systems
This vulnerability affects any WordPress site running Rank Math SEO PRO version 3.0.95 or earlier. The vendor is Rank Math. No specific version impact ranges beyond 3.0.95 are provided, so all earlier releases are considered vulnerable.
Risk and Exploitability
The CVSS score of 4.3 indicates low severity, and the EPSS score below 1% suggests a low probability of exploitation. The issue is not catalogued in the CISA KEV list. Likely exploitation would occur over the web: an authenticated user or one who can send crafted HTTP requests to the plugin’s endpoints may bypass role checks and access privileged settings. Because it requires at least a basic user account with permission to interact with the plugin, the threat surface is limited compared to fully unauthenticated attacks.
