PT-2026-44796 · WordPress · Rank Math Seo

Abrahack + 1 · CVE-2025-12714 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rank Math SEO versions prior to 1.0.272

Description The Rank Math SEO plugin for WordPress allows unauthorized access because the update site editor homepage() function lacks a capability check. This allows unauthenticated attackers to modify various plugin settings, such as the homepage title, meta description, breadcrumbs label, and social media metadata. Such modifications can negatively impact SEO rankings and enable the display of malicious content on all site pages where breadcrumbs are implemented.

Recommendations Update the plugin to version 1.0.272 or later. As a temporary workaround, restrict access to the update site editor homepage() function until the update is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12714

Affected Products

Rank Math Seo

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12714 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/dd072774-6f85-42de-a9d4-6826703ad839?source=cve · Note
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L339 · Note
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-rest-helper.php#L75 · Note
• https://twitter.com/VulmonFeeds/status/2060353627097596119 · Twitter Post
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L129 · Note
• https://plugins.trac.wordpress.org/changeset/3552223/seo-by-rank-math/trunk/includes/rest/class-rest-helper.php · Note
• https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L122 · Note
• https://t.me/cveNotify/208739 · Telegram Post
• https://t.me/cveNotify/165164 · Telegram Post