The Rank Math SEO WordPress plugin, in versions prior to 1.0.277, does not validate that an authenticated user is authorized to edit a content, taxonomy, or user profile object before updating that object's SEO indexing metadata. An Author or higher‑role user can therefore modify the SEO data of items they do not own and can remove other users’ content from the site’s sitemap and search engine index. This flaw is a CWE‑639 type of authorization weakness that allows unauthorized metadata alteration and visibility changes.

Any WordPress installation that has the Rank Math SEO plugin installed with a version older than 1.0.277 is affected. The vulnerability applies to all Authenticated users who hold the Author role or any higher role, regardless of whether the content belongs to them.

The vulnerability can be exploited by an authenticated user through normal plugin functionality. Its CVSS score of 2.7 indicates low severity, and the EPSS score of less than 1% points to a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. Although the risk to system integrity or confidential data is minimal, the ability to remove or alter content from search engine indexes can impact site visibility and reputation.