CVE-2026-77786
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
Risk Assessment
Users with the Editor role can change critical site settings, potentially leading to security breaches, malfunction, or takeover of the website.
Recommendation
It is recommended to update the Rank Math SEO plugin to version 1.0.277 or later, which includes a fix for capability checking.
Other vulnerabilities in Rank Math SEO
See all- CVE-2026-81757High
Vulnerability allowing remote code execution (RCE) by a user with the author role in the Rank Math SEO plugin in versions up to and including 1.0.276.
- CVE-2026-66702High
Cross Site Scripting (XSS) vulnerability in Rank Math SEO plugin up to version 1.0.274.1, allowing an unauthenticated attacker to inject malicious scripts into pages.
- CVE-2026-34892Medium
There is a broken access control issue in Rank Math SEO versions up to 1.0.271 that may allow unauthorized users to access subscription features.
Original NVD description (English source)
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.