Rank Math SEO Missing Capability Check Vulnerability Allowing Unauthorized Schema Metadata Deletion

A vulnerability exists in the Rank Math SEO plugin for WordPress, specifically in versions through 1.0.235. The issue arises from a missing capability check in the update_metadata() function, which allows authenticated attackers with Contributor-level access or higher to delete schema metadata from any post. This unauthorized data loss could disrupt the SEO functionality of affected posts by removing critical schema information.

Impact

Exploitation of this vulnerability allows for the arbitrary deletion of schema metadata from posts, which could negatively affect the SEO performance of those posts by removing important structured data.

Remediation

Users can update to Rank Math SEO version 1.0.236 or later to address this vulnerability.