CVE-2025-12714 is a missing authorization vulnerability (CWE-862) in the Rank Math SEO WordPress plugin affecting versions up to 1.0.271. The vulnerability arises because the update_site_editor_homepage function lacks a capability check, enabling unauthenticated attackers to alter various SEO-related settings including homepage title, meta description, breadcrumbs label, and social media metadata. This unauthorized access can degrade SEO performance and inject malicious content into site pages that utilize breadcrumbs. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 3.1 base score is 5.3 (medium severity), reflecting limited impact on confidentiality but notable impact on integrity. No patch or official fix has been documented by the vendor as of the published date.

An attacker can modify SEO-related settings on affected WordPress sites without authentication, potentially degrading search engine rankings and causing malicious or misleading content to appear on site pages that use breadcrumbs. There is no direct impact on confidentiality or availability reported. The integrity of site metadata and SEO configuration is compromised, which can have reputational and operational consequences for site owners.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting access to plugin files via web server controls or disable the plugin if feasible. Monitoring for unauthorized changes to SEO settings is recommended. Avoid exposing the update_site_editor_homepage function to unauthenticated users through custom access controls if possible.