CVE-2026-34892
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
There is a broken access control issue in Rank Math SEO versions up to 1.0.271 that may allow unauthorized users to access subscription features.
Risk Assessment
Organizations may be exposed to unauthorized access to subscriber data, potentially leading to information leaks or abuse.
Recommendation
It is recommended to update the Rank Math SEO plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in Rank Math SEO
See all- CVE-2026-77786Low risk· EPSS 3%
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
- CVE-2026-81757High
Vulnerability allowing remote code execution (RCE) by a user with the author role in the Rank Math SEO plugin in versions up to and including 1.0.276.
- CVE-2026-66702High
Cross Site Scripting (XSS) vulnerability in Rank Math SEO plugin up to version 1.0.274.1, allowing an unauthenticated attacker to inject malicious scripts into pages.
Original NVD description (English source)
Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.