CVE-2026-104751: Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion

Q: Who can exploit this issue?

Any unauthenticated user can trigger deletion of the plugin's stored SEO analysis data because the affected functionality lacks both a capability check and a nonce check.

Q: Which installations are affected?

Rank Math SEO versions before 1.0.280 are affected. The available information does not identify any configuration prerequisite.

Q: What is the impact of successful exploitation?

An attacker can clear stored SEO analysis results. The provided information does not indicate that posts, site content, user accounts, or WordPress settings can be modified through this issue.

Published Oct 14, 2026

Updated

The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.

Affected Software

1 affected component

Rank Math Rank Math SEO<1.0.280

Event History

Oct 14, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can trigger deletion of the plugin's stored SEO analysis data because the affected functionality lacks both a capability check and a nonce check.

Which installations are affected?

Rank Math SEO versions before 1.0.280 are affected. The available information does not identify any configuration prerequisite.

What is the impact of successful exploitation?

An attacker can clear stored SEO analysis results. The provided information does not indicate that posts, site content, user accounts, or WordPress settings can be modified through this issue.