The Rank Math SEO plugin contains a missing authorization flaw that permits authenticated users with non‑administrator roles to access administrative endpoints that should be restricted. The description indicates that the issue results from incorrectly configured access control security levels, so it is inferred that attackers can exploit the vulnerability to perform privileged actions such as modifying plugin settings or viewing sensitive information, thereby compromising confidentiality, integrity, and availability.

All WordPress installations that have the Rank Math SEO plugin version 1.0.271 or earlier are affected. The issue manifests when a subscriber or any account with a non‑administrator role interacts with the plugin’s administrative endpoints.

The CVSS score of 6.5 categorizes the vulnerability as medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate to the site using a subscriber account and then send HTTP requests to the plugin’s admin URLs that lack proper authorization checks, making the vector web‑based and requiring the user to be logged in.