The Rank Math SEO WordPress plugin before version 1.0.277 performs a bulk metadata update via the updateMetaBulk function without verifying that the caller has the required privileges. The function reuses the supplied object identifier across multiple object types, allowing an authenticated user with the Author role or higher to modify SEO metadata for taxonomy terms that they are normally not allowed to edit and to overwrite the titles of posts belonging to other users. This flaw can compromise the integrity of post content and could be leveraged to manipulate search engine optimization settings or to hide or vandalize content. The vulnerability is a classic example of Improper Access Control as it permits privileged users to affect resources beyond their scope.

Any WordPress installation running Rank Math SEO plugin with a version older than 1.0.277 is affected. The plugin may be installed on any site that relies on Rank Math for SEO management, including blogs, corporate websites, and e‑commerce storefronts. Users with the Author role or higher (including Editors, Admins, and Super Admins in multisite) are the primary threat actors; any site with a full administrative user base that cannot be constrained is at risk.

The CVSS score of 2.7 indicates low severity, and EPSS is not available, so a precise quantitative risk cannot be assigned. The flaw is not listed in the CISA KEV catalog and has no publicly known exploits at this time. However, the low barrier to exploitation – simply logging in as an Author or higher and invoking the updateMetaBulk endpoint – means that the potential for immediate disruption exists on any unpatched site. The impact is limited to data integrity (metadata and post titles) and does not provide remote code execution or privilege escalation. Nonetheless, the cost of a post title overwrite can be high in e‑commerce or legal compliance contexts, and unauthorized metadata changes can degrade SEO performance and trust.