CVE-2025-12714
Last modified
CVE-2025-12714 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to modify several plugin settings including homepage title, meta description, breadcrumbs label, and social media metadata, which can have severe impact on SEO rankings and display malicious content across all site pages where breadcrumbs are used.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to modify several plugin settings including homepage title, meta description, breadcrumbs label, and social media metadata, which can have severe impact on SEO rankings and display malicious content across all site pages where breadcrumbs are used.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-12714?
How severe is CVE-2025-12714?
How do I fix CVE-2025-12714?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-12709The Interactions – Create Interactive Experiences in the Blo…6.4
- CVE-2025-1271Reflected Cross-Site Scripting (XSS) in Anapi Group's h6web.…6.1
- CVE-2025-12710The Pet-Manager – Petfinder plugin for WordPress is vulnerab…6.4
- CVE-2025-12711The Share to Google Classroom plugin for WordPress is vulner…6.4
- CVE-2025-12712The Shouty plugin for WordPress is vulnerable to Stored Cros…6.4
- CVE-2025-12713The Soundslides plugin for WordPress is vulnerable to Stored…6.4
- CVE-2025-12715The Canadian Nutrition Facts Label plugin for WordPress is v…6.4
- CVE-2025-12716GitLab has remediated an issue in GitLab CE/EE affecting all…8.7
- CVE-2025-12717The List Attachments Shortcode plugin for WordPress is vulne…6.4
- CVE-2025-12718The Quick Contact Form plugin for WordPress is vulnerable to…5.8
- CVE-2025-1272The Linux Kernel lockdown mode for kernel versions starting …7.7
- CVE-2025-12720The g-FFL Cockpit plugin for WordPress is vulnerable to unau…5.3
Are you affected by CVE-2025-12714?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST