The Rank Math SEO plugin before 1.0.277 fails to verify that the user invoking the automatic SEO fix has the proper WordPress capability required for the specific settings it modifies. This allows any user with the Editor role, a role that normally lacks permission to change core WordPress configuration, to alter site‑wide settings that are reserved for administrators. The primary impact is a privilege escalation that can affect the confidentiality, integrity, and availability of the site by enabling unauthorized changes to essential WordPress settings.

Affected product is the Rank Math SEO WordPress plugin, version earlier than 1.0.277. All WordPress installations that use this plugin and have Editor‑level users are potentially vulnerable. The vendor, Unknown:Rank Math SEO, released the fix in version 1.0.277, so any installations on that version or later are considered safe.

Although no EPSS score or CVSS score is provided, the lack of capability checks suggests the vulnerability can be exploited by any authenticated Editor user simply by triggering the fix‑site‑seo functionality. The omission of a check means the exploitability is high if an Editor role is present. Since the vulnerability does not require network exposure beyond the normal WordPress admin area, the attack vector is inferred to be local role‑based. The risk remains significant for sites with large numbers of Editor users, and the potential for misconfiguring core settings means the impact could be substantial.