CVE-2026-104751 Overview
CVE-2026-104751 is a missing authorization vulnerability in the Rank Math SEO WordPress plugin before version 1.0.280. The plugin fails to perform a capability or nonce check before clearing its stored SEO analysis data. Unauthenticated attackers can trigger the deletion action remotely over the network without any user interaction. The flaw is categorized under [CWE-862] Missing Authorization.
Critical Impact
Unauthenticated remote attackers can delete stored SEO analysis data from any affected WordPress site, degrading SEO insights and operational integrity.
Affected Products
- Rank Math SEO WordPress plugin versions prior to 1.0.280
Discovery Timeline
- 2026-10-14 - CVE-2026-104751 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-104751
Vulnerability Analysis
The Rank Math SEO plugin exposes functionality that clears stored SEO analysis data without validating the requester's identity or intent. Because neither a WordPress capability check nor a nonce verification occurs before the data-clearing routine runs, any network client can invoke it. The resulting impact is limited to integrity loss on the stored analysis data; confidentiality and availability of the broader site are not directly affected.
According to the WPScan Vulnerability Advisory, the issue is addressed in version 1.0.280 of the plugin.
Root Cause
The root cause is the absence of two standard WordPress authorization controls on the handler that clears SEO analysis data. First, the plugin omits a current_user_can() capability check that would restrict the action to privileged administrators. Second, it omits a check_admin_referer() or wp_verify_nonce() call that would bind the request to an authenticated session. Together these omissions make the handler reachable by unauthenticated requests.
Attack Vector
An attacker sends a crafted HTTP request to the vulnerable endpoint exposed by the plugin on a target WordPress site. No authentication, privileges, or user interaction are required. On success, the plugin discards its stored SEO analysis data, forcing site owners to regenerate it. The vulnerability does not grant code execution or data exfiltration.
No verified public exploit code is available at the time of publication. See the WPScan Vulnerability Advisory for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104751
Indicators of Compromise
- Unexpected emptying of Rank Math SEO analysis results in the WordPress admin dashboard without a corresponding administrator action.
- Access log entries containing requests to Rank Math SEO administrative endpoints originating from unauthenticated sessions or unexpected IP addresses.
Detection Strategies
- Review the installed Rank Math SEO plugin version and flag any instance below 1.0.280 as vulnerable.
- Correlate web server logs with WordPress audit logs to identify requests that trigger SEO analysis clearing without an authenticated admin session.
- Monitor for anomalous admin-ajax.php or REST API calls targeting Rank Math SEO action parameters.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to capture plugin-level data mutation events.
- Alert when SEO analysis data counts drop to zero outside of planned maintenance windows.
- Track outbound requests from scanning infrastructure that fingerprint Rank Math SEO versions.
How to Mitigate CVE-2026-104751
Immediate Actions Required
- Update the Rank Math SEO plugin to version 1.0.280 or later on every WordPress site under management.
- Audit administrative access logs for prior unauthenticated requests to Rank Math SEO endpoints.
- Re-generate SEO analysis data if integrity loss is suspected after upgrading.
Patch Information
The vendor fixed the missing authorization check in Rank Math SEO version 1.0.280. Site operators should install the patched release through the WordPress plugin updater or by replacing the plugin files manually. Confirm the installed version in wp-admin > Plugins after upgrade.
Workarounds
- Restrict access to WordPress administrative endpoints such as admin-ajax.php and the REST API using web application firewall rules until the plugin is updated.
- Temporarily deactivate the Rank Math SEO plugin on sites that cannot be patched immediately.
- Limit inbound HTTP access to the WordPress admin surface by source IP where feasible.
# Example WP-CLI command to upgrade Rank Math SEO to the patched version
wp plugin update seo-by-rank-math --version=1.0.280
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
