CVE-2026-77782
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Rank Math SEO WordPress plugin before version 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata. This allows unauthenticated users to read the content of password-protected posts.
Risk Assessment
The risk is the disclosure of post content that should only be accessible to authorized users, potentially compromising data confidentiality and privacy.
Recommendation
Update the Rank Math SEO plugin to version 1.0.277.1 or later, which adds password protection checks before using content in SEO metadata.
Other vulnerabilities in Rank Math SEO WordPress Plugin
See all- CVE-2026-1928High
The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can inject a PHP object, and the presence of a POP chain allows remote code execution by writing a webshell to the uploads directory.
- CVE-2026-77788Medium
The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against. This allows users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
Original NVD description (English source)
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS