--- title: "Rank Math security vulnerabilities: the timeline since 2020" description: "Unauthenticated privilege escalation in 2020, code execution, a burst of flaws in 2026: the verified Rank Math SEO history and how to protect your site." language: "en" locale: "en-US" type: "article" canonical: "https://www.wp-masquerade.com/rank-math-security-vulnerabilities/" published: "2026-10-10T07:00:00+00:00" modified: "2026-10-29T07:36:25+00:00" translations: en-US: "https://www.wp-masquerade.com/rank-math-security-vulnerabilities/index.md" fr-FR: "https://www.wp-masquerade.com/fr/failles-securite-rank-math/index.md" es-ES: "https://www.wp-masquerade.com/es/vulnerabilidades-rank-math/index.md" de-DE: "https://www.wp-masquerade.com/de/rank-math-sicherheitsluecken/index.md" it-IT: "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-rank-math/index.md" pt-BR: "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-rank-math/index.md" nl-NL: "https://www.wp-masquerade.com/nl/rank-math-kwetsbaarheden-beveiliging/index.md" --- # Rank Math security vulnerabilities: the timeline since 2020 29 vulnerabilities according to WPScan since 2020, including the critical March 2020 flaw that granted administrator rights without an account and eleven advisories in 2026: the verified Rank Math SEO timeline and the settings that reduce the risk. In March 2020, a Rank Math REST API route let any visitor, without an account, grant themselves administrator rights on a WordPress site. The plugin has since grown its installations twentyfold, and the security advisories have followed: eleven in 2026 alone, as of October 7. Here is the verified timeline, what each vulnerability actually allowed and the settings that reduce your exposure. ## Rank Math SEO in brief Rank Math SEO is an SEO plugin released on wordpress.org in November 2018. Its founders, who already ran the MyThemeShop theme store, started developing it in 2015 for their own sites before making it public in late 2018. It now has more than 4 million active installations (wordpress.org), compared with just over 200,000 in March 2020. A paid version, Rank Math PRO, adds modules; it is covered separately below. Rank Math stands out for its many modules: redirections, schema, SEO analysis, role manager, `.htaccess` editor, "headless" mode, `llms.txt`, AI. Almost everything goes through REST API routes that write post, term and user metadata. And a WordPress user's permissions are themselves stored in their metadata. ## Security advisories from 2020 to October 2026 From January 1, 2020 to October 7, 2026, the WPScan database lists 29 vulnerabilities in the free plugin, which we cross-checked against the [CVE](https://www.wp-masquerade.com/glossary/cve/) records, Patchstack, NVD, the press and the Rank Math changelog. The table keeps the vulnerabilities exploitable without an account or by a subscriber, those rated 7 or higher and those leading to code execution; the sixteen others are summarized afterward. ![Timeline of Rank Math SEO vulnerabilities: unauthenticated privilege escalation and redirections on March 31, 2020 (1.0.41), competing plugins deactivated on April 18, 2020, SSRF in August 2022, file inclusion in January 2023, four XSS in 2024, metadata and PHP object injection on October 4, 2024 (1.0.229), .htaccess on November 22, 2024 (1.0.232), homepage changed without an account and a subscriber vulnerability in May and June 2026 (1.0.271.1), unauthenticated XSS on July 31, 2026, code execution on August 27, 2026 (1.0.277), six vulnerabilities on August 31, 2026](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-rank-math-en.webp) *Fourteen notable events; the only critical vulnerability dates from March 2020.* | Published | Fixed in | Type | CVSS | CVE | Account required | Exploitation | | --- | --- | --- | --- | --- | --- | --- | | March 31, 2020 | 1.0.41 | Privilege escalation via the `updateMeta` REST route | 9.8 (NVD); 10 (Wordfence in 2020) | CVE-2020-11514 | None | Not documented | | March 31, 2020 | 1.0.41 | Redirection creation via the `updateRedirection` route | 6.1 (NVD); 7.4 (Wordfence in 2020) | CVE-2020-11515 | None | Not documented | | August 12, 2022 | 1.0.95.1 | Server-side request forgery (SSRF), headless mode | 6.8 (Patchstack) | CVE-2022-36376 | None | Not documented | | January 30, 2023 | 1.0.107.3 | Local file inclusion | 7.6 (Patchstack); 4.9 (WPScan) | CVE-2023-23888 | Contributor | Not documented | | October 4, 2024 | 1.0.229 | Adding, changing and deleting metadata | 6.5 (Wordfence) | CVE-2024-9161 | None | Not documented | | October 4, 2024 | 1.0.229 | PHP object injection (redirection import) | 7.2 (Wordfence) | CVE-2024-9314 | Administrator | Not documented | | November 22, 2024 | 1.0.232 | `.htaccess` rewrite leading to code execution | 7.2 (Patchstack); 6.6 (WPScan) | CVE-2024-11620 | Administrator | Not documented | | May 28, 2026 | 1.0.271.1 | Changing the homepage SEO settings | 5.3 (Wordfence) | CVE-2025-12714 | None | Not documented | | June 3, 2026 | 1.0.271.1 | Broken access control | 6.5 (Patchstack) | CVE-2026-34892 | Subscriber | Not documented | | July 31, 2026 | 1.0.275 | Stored XSS | 7.1 (Patchstack); 7.2 (WPScan) | CVE-2026-66702 | None (victim action) | Not documented | | August 27, 2026 | 1.0.277 | Remote code execution | 7.2 (Patchstack, WPScan) | CVE-2026-81757 | Author | Not documented | | August 31, 2026 | 1.0.277.1 | Password-protected post content exposed (metadata, `llms.txt`) | 5.3 (WPScan) | CVE-2026-77782 | None | Not documented | | August 31, 2026 | 1.0.277 (affected: 1.0.48 to 1.0.276) | Overwriting post and user metadata | 4.9 (WPScan) | CVE-2026-77788 | Author | Not documented | *Notable Rank Math SEO vulnerabilities published from January 1, 2020 to October 7, 2026. "Not documented": no attack described in the sources consulted.* The sixteen other vulnerabilities are of medium or low severity. In 2020, a subscriber could deactivate competing SEO plugins (1.0.42.2), a flaw reported by Sybre Waaijer, author of The SEO Framework. In 2023, a stored [XSS](https://www.wp-masquerade.com/glossary/xss/) by a contributor (1.0.119.1). In 2024, four contributor XSS in the HowTo and FAQ blocks (1.0.215 to 1.0.219) and an XSS in the settings (1.0.219). In 2025, an XSS and schema deletion by a contributor (1.0.236), then information exposure to a subscriber and an authorization flaw (1.0.253). In 2026, five vulnerabilities fixed in 1.0.277: core settings changeable by an editor, other users' metadata changeable and non-public content readable by an author, and the schema of unpublished content visible without an account. ## The notable vulnerabilities explained ### March 2020: administrator in a single request On March 23, 2020, the Wordfence Threat Intelligence team analyzed Rank Math and found two REST routes registered without a `permission_callback`, the parameter that tells WordPress who is allowed to call them. The first, `rankmath/v1/updateMeta`, called the `update_metadata` function: it could change a post's slug and the metadata of posts, comments, terms and users. Since a user's roles are stored in their metadata, an anonymous visitor could give administrator rights to any registered account, including their own, or strip the existing administrator, often user number 1, of their rights and lock them out of their own site. The second route, `rankmath/v1/updateRedirection`, let anyone without an account create redirections from almost any address on the site to a domain of their choice; only existing files and folders, including the homepage, were spared. First contact on March 24, details sent on the 25th, fix released on the 26th: two days. Wordfence published its analysis on March 31; its Premium customers had a firewall rule from March 24, free users from April 23. ### 2022 and 2023: SSRF and file inclusion Rafie Muhammad of Patchstack authored the next two advisories. In August 2022, with the "headless" setting enabled, normally blocked REST routes became reachable and let a visitor make the server send requests to other addresses ([SSRF](https://www.wp-masquerade.com/glossary/ssrf/)). In January 2023, the `update_schemas` and `get_snippet_content` functions did not check paths: a contributor could make the site include a local PHP file (7.6 for Patchstack, 4.9 for WPScan). ### October 2024: the same function, four years later Researcher Leo Trinh reported two flaws fixed in 1.0.229 on October 3, 2024 and published by Wordfence the next day. The first echoes March 2020: the `update_metadata` function lacked a capability check. Without an account, one could create or change metadata starting with `rank_math` and delete any user or term metadata, to the point of cutting an administrator off from their dashboard. The second is a PHP object injection: the `set_redirections` function, which imports redirections, unserialized user-supplied data. An administrator account was required, and Rank Math contains no exploitable chain (POP chain); another plugin could provide one, with file deletion or code execution as the result. The mechanism is detailed in [our article on PHP object injection](https://www.wp-masquerade.com/php-deserialization-object-injection/). ### November 2024: the .htaccess editor Rank Math lets you edit the `.htaccess` file from its settings. On November 5, 2024, Rafie Muhammad showed that this file could be rewritten to the point of executing code. Version 1.0.232 of November 13 fixed it; Patchstack published the advisory on the 22nd. According to the changelog, the risk concerned users with access to the general settings: administrators by default, but Rank Math's role manager can open this access to other roles. ### May 2026: seven months to fix The `update_site_editor_homepage` function had no capability check: without an account, one could change the homepage title and meta description, the breadcrumb label and the social metadata, and therefore display one's own text on every page that has breadcrumbs. According to Wordfence's CVE record, the vendor was notified on November 4, 2025; version 1.0.271.1 only came out on May 28, 2026. It also fixed a vulnerability open to a subscriber, reported to Patchstack on March 18 by Jakub Herman. ### Summer 2026: unauthenticated XSS, code execution and a burst of advisories On July 31, Patchstack published an XSS exploitable without an account (7.1), reported on July 10 by Rafie Muhammad; a logged-in user must take an action, such as opening a booby-trapped link. Version 1.0.275 of July 28 fixed it. On August 27, Patchstack published a remote code execution open to an author, reported on August 20 by Ananda Dhakal and fixed in 1.0.277 as early as the 26th, with no public technical details. At the end of August, WPScan published seven vulnerabilities fixed in 1.0.277 and 1.0.277.1, reported notably by Project Black, Mohammed Abd Alrahman and Usama Arshad. Rank Math used the content of password-protected posts to build public metadata and the `llms.txt` file: a visitor could read it. And the `updateSchemas` route let an author overwrite post and user metadata, including that of more privileged accounts. ### What about Rank Math PRO? The paid version is not included in the count. Patchstack lists two vulnerabilities in it before October 2026: an unauthenticated reflected XSS up to 3.0.35 (CVE-2023-32800, 7.1, May 2023) and an authorization flaw up to 3.0.95 (CVE-2026-28080, 4.3, March 2026). It is updated separately. ![Bar chart of Rank Math SEO vulnerabilities per year according to WPScan: 3 in 2020 including one critical, none in 2021, 1 in 2022, 2 in 2023, 8 in 2024, 4 in 2025 and 11 in 2026 up to October 7 including two high](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-rank-math-en.webp) *29 vulnerabilities according to WPScan from January 1, 2020 to October 7, 2026, eleven of them in 2026.* ## Lessons from six years of advisories - **Metadata, the plugin's Achilles' heel.** `updateMeta` in 2020, `update_metadata` in 2024 and 2025, `updateSchemas` and `updateMetaBulk` in 2026: each fix closes one access point without addressing the root issue, checking for every modified object that the user is allowed to touch it. - **The pace is accelerating.** Three vulnerabilities in 2020, none in 2021, eight in 2024, eleven in 2026 as of October 7. New features add routes, and bug bounty programs attract researchers. - **Highly variable delays.** Two days in 2020, eight days for the `.htaccess` flaw, six for the August 2026 code execution, but seven months for the homepage vulnerability. - **The role manager widens the surface**: "administrator-only" vulnerabilities become reachable by the roles it opens the settings to. - **Compared with other SEO plugins**, Rank Math has more advisories than Yoast SEO, which has had no critical vulnerability in its free version since 2020 ([Yoast SEO timeline](https://www.wp-masquerade.com/yoast-seo-security-vulnerabilities/)), and resembles [All in One SEO](https://www.wp-masquerade.com/all-in-one-seo-security-vulnerabilities/): REST access controls, a recent acceleration, a single critical vulnerability. For context, see [plugin vulnerabilities by the numbers](https://www.wp-masquerade.com/wordpress-plugin-vulnerabilities-statistics/), our guide to [REST API routes](https://www.wp-masquerade.com/wordpress-rest-api-security/) and, for WordPress core, the [timeline of security releases](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/). ## Protecting your site - **Upgrade to at least 1.0.277.1**, which fixes every vulnerability in this table; version 1.0.280 of October 6, 2026 adds further hardening. Also update Rank Math PRO if you use it. - **Turn on automatic updates** for Rank Math: fixes often come out before the public advisory, sometimes by several days. Our guide to automatic plugin updates explains how. - **Check Rank Math's role manager**: give access to the general settings, redirections and the `.htaccess` editor to administrators only. Also review your accounts' roles (principle of least privilege). - **Turn off unused modules** in the Rank Math dashboard (redirections, schema, `llms.txt`) and the headless setting if you do not use it: a disabled module exposes fewer routes. - **Close registration** if your visitors do not need an account (Settings, General), and keep a single SEO plugin: delete the others (abandoned plugins). - **Add a web application firewall** with virtual patching for the delay before updating (WAF comparison) and monitor your plugins' vulnerabilities. WP Masquerade Pro can keep you from missing an advisory. Every day, it compares your plugin versions with the public WPVulnerability.net database and sends you an [email alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) with the severity and the fixed version ([alert settings](https://www.wp-masquerade.com/features/email-alerts/)). The member area lists pending updates and vulnerable sites ([monitoring your sites](https://www.wp-masquerade.com/features/#surveillance)). It alerts, it does not fix: it does not install updates and it is not a firewall. See also our selection of the [best security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/). ### Key takeaways - 29 vulnerabilities according to WPScan from January 1, 2020 to October 7, 2026, one of them critical: the unauthenticated privilege escalation of March 2020, fixed in 1.0.41 two days after it was reported. - REST routes that write metadata are the plugin's recurring weakness, from 2020 to 2026. - 2026 is the busiest year: eleven advisories, including an unauthenticated XSS and code execution by an author. - Update to 1.0.277.1 at least and restrict access to the settings through the role manager. - No attack is documented in the sources consulted. ## Sources - WordPress.org: Rank Math SEO, description and active installations (https://wordpress.org/plugins/seo-by-rank-math/) - NVD: CVE-2020-11514, Rank Math unauthenticated metadata update (April 7, 2020) (https://nvd.nist.gov/vuln/detail/CVE-2020-11514) - CVE.org: CVE-2024-9161, Rank Math SEO Unauthenticated User and Term Metadata Insert, Update, and Delete (October 5, 2024) (https://www.cve.org/CVERecord?id=CVE-2024-9161) - Rank Math: free version changelog (https://rankmath.com/changelog/free/) Other sources consulted: further CVE records, trade press articles, WPScan and Patchstack databases. **Update, October 28, 2026:** backdoored copies of the paid Rank Math PRO 3.0.123 plugin were distributed from October 15, 2026 at 20:02 UTC to October 16 at 07:12 UTC (CVE-2026-111862). Version 3.0.124 is clean, and the free plugin is not affected according to the vendor. Full details: [Rank Math PRO hacked: version 3.0.123 shipped with a backdoor](https://www.wp-masquerade.com/rank-math-pro-3-0-123-backdoor/). ## WordPress security, without the noise One e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.