{"id":"CVE-2025-12958","aliases":["EUVD-2026-1328","GHSA-x8rq-m8j4-85pr"],"status":"published","title":"Rankology SEO and Analytics Tool \u003c= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header \u0026 Footer Code Creation","description":"The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' page in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Editor-level access and above, to add header and footer code blocks.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00249,"percentile":0.16336,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2026-01-07T08:21:54Z","modified":"2026-06-17T08:33:16Z","products":[{"vendor":"rankology","product":"rankology seo and analytics tool"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c97a341c-23f5-49a9-ad05-1fb387047e3b?source=cve"},{"url":"https://wordpress.org/plugins/rankology-seo-and-analytics-tool/"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3441084%40rankology-seo-and-analytics-tool\u0026new=3441084%40rankology-seo-and-analytics-tool\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12958"},{"url":"https://wordpress.org/plugins/rankology-seo-and-analytics-tool"},{"url":"https://github.com/advisories/GHSA-x8rq-m8j4-85pr"}],"sources":{"cve":[{"id":"CVE-2025-12958","title":"Rankology SEO and Analytics Tool \u003c= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header \u0026 Footer Code Creation","description":"The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' page in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Editor-level access and above, to add header and footer code blocks.","status":"published","published":"2026-01-07T08:21:54.071Z","modified":"2026-04-08T17:21:51.529Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2026-1328","description":"The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' page in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Editor-level access and above, to add header and footer code blocks.","status":"published","published":"2026-01-07T08:21:54Z","modified":"2026-04-08T17:21:51Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:24:40.44402Z"}],"ghsa":[{"id":"GHSA-x8rq-m8j4-85pr","title":"The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized...","description":"The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' page in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Editor-level access and above, to add header and footer code blocks.","status":"published","published":"2026-01-07T12:31:20Z","modified":"2026-04-08T21:33:10Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:07:20.927537Z"}],"nvd":[{"id":"CVE-2025-12958","description":"The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' page in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Editor-level access and above, to add header and footer code blocks.","status":"published","published":"2026-01-07T12:16:47.28Z","modified":"2026-06-17T08:33:16.99Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:11:55.613137Z"}]}}