CVE-2026-77788
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against. This allows users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
Risk Assessment
The risk is the ability to manipulate post and user metadata, which could lead to privilege escalation, content defacement, or data integrity compromise.
Recommendation
Update the Rank Math SEO plugin to version 1.0.277 or later, which fixes the authorization verification issue when updating metadata.
Other vulnerabilities in Rank Math SEO WordPress Plugin
See all- CVE-2026-1928High
The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can inject a PHP object, and the presence of a POP chain allows remote code execution by writing a webshell to the uploads directory.
- CVE-2026-77782Medium
The Rank Math SEO WordPress plugin before version 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata. This allows unauthenticated users to read the content of password-protected posts.
Original NVD description (English source)
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS