PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-104751 Rank Math CVE debrief

CVE-2026-104751 is a vulnerability in the Rank Math SEO WordPress plugin before version 1.0.280 that allows unauthenticated users to delete stored SEO analysis data. The vulnerability exists because the plugin does not perform a capability or nonce check before clearing its stored SEO analysis data. This could allow an attacker to delete SEO analysis data, potentially impacting the website's search engine optimization. Defenders responsible for WordPress installations with the Rank Math SEO plugin should assess exposure and prioritize verification and remediation.

Vendor
Rank Math
Product
SEO Plugin
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for WordPress installations with the Rank Math SEO plugin should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-104751 is a vulnerability in the Rank Math SEO WordPress plugin that allows unauthenticated users to delete stored SEO analysis data. Defenders responsible for WordPress installations with the Rank Math SEO plugin should assess exposure and prioritize verification and remediation.

  • Unauthenticated users can delete SEO analysis data
  • Defenders need to verify the version of the Rank Math SEO plugin
  • Remediation priority is high for WordPress installations with the vulnerable plugin

Technical summary

The Rank Math SEO WordPress plugin before version 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it. This vulnerability could be exploited by an attacker to delete SEO analysis data, potentially impacting the website's search engine optimization. The plugin's failure to validate requests allows for unauthorized deletion of SEO analysis data.

Defensive priority

Defenders should prioritize verifying the version of the Rank Math SEO plugin and ensuring that it is updated to version 1.0.280 or later.

Recommended defensive actions

  • Verify the version of the Rank Math SEO plugin and update to version 1.0.280 or later
  • Restrict access to the Rank Math SEO plugin's settings and data
  • Monitor for suspicious activity related to SEO analysis data deletion

Evidence notes

The vulnerability was reported by WPScan and is documented in the CVE Program record and the NVD vulnerability detail page. The source item providing details on the vulnerability also confirms this information. There are no known reports of this vulnerability being exploited in the wild, but defenders should verify the version of the Rank Math SEO plugin and ensure that it is updated to version 1.0.280 or later.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-104751 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-104751

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-104751 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-104751

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.