CVE-2026-77787
Received Received - Intake

Rank Math SEO Plugin Metadata Manipulation Vulnerability

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-77787
EUVD
EUVD-2026-69841

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rank_math seo_plugin to 1.0.277 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Rank Math SEO WordPress plugin before version 1.0.277 allows users with Author role or higher to exploit missing capability checks during bulk metadata updates. The flaw enables modification of SEO metadata for taxonomy terms they cannot edit and overwriting post titles of other users by reusing object identifiers across different object types.

Detection Guidance

To detect this vulnerability, check the installed version of the Rank Math SEO plugin. If it is below 1.0.277, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files directly.

Impact Analysis

An attacker with Author role or higher could change SEO metadata for terms they shouldn't access and overwrite titles of posts belonging to other users. This could lead to misinformation, SEO manipulation, or unauthorized content changes on the WordPress site.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves unauthorized modification of SEO metadata and post titles in WordPress. However, if exploited, it could lead to unauthorized changes in content visibility or metadata, potentially impacting data integrity or confidentiality depending on the context of the affected site.

Mitigation Strategies

Immediately update the Rank Math SEO plugin to version 1.0.277 or later. If updating is not possible, consider disabling the plugin temporarily until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77787. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart