CVE-2025-32491CWE-266

WordPress Rankology SEO – On-site SEO plugin <= 2.2.4 - Privilege Escalation Vulnerability

Critical · published April 11, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

🚨 A sneaky privilege escalation vulnerability lurks in Rankology SEO, allowing users to gain unintended access! 🔥 This vulnerability is like a waiter who accidentally gives a diner a key to the VIP lounge without checking if they actually belong there — suddenly, anyone can access sensitive information or perform actions they shouldn't! An attacker could exploit this flaw to gain elevated privileges, allowing them to manipulate SEO settings or access confidential data, potentially leading to devastating repercussions for your website's performance and reputation. It's a serious breach that could leave your digital presence vulnerable!

Put simply

This vulnerability is like a waiter who accidentally gives a diner a key to the VIP lounge without checking if they actually belong there — suddenly, anyone can access sensitive information or perform actions they shouldn't! The incorrect privilege assignment in Rankology SEO allows unauthorized users to escalate their access rights, enabling them to perform actions reserved for higher-privileged accounts.

What to do

An attacker could exploit this flaw to gain elevated privileges, allowing them to manipulate SEO settings or access confidential data, potentially leading to devastating repercussions for your website's performance and reputation. It's a serious breach that could leave your digital presence vulnerable! Immediately update your Rankology SEO plugin to version 2.2.5 or later to patch this vulnerability. Review user permissions and remove any unnecessary elevated privileges from accounts. Stay vigilant by regularly auditing your plugins and their permissions! You've got this! Follow these steps, and you'll have your site secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.0th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-04-11T08:42Z
EPSS history
Timeline
  • 11 APR 08:42Z
    WordPress Rankology SEO – On-site SEO plugin <= 2.2.4 - Privilege Escalation Vulnerability
    cvelistv5