CVE-2026-77782: Rank Math SEO Information Disclosure Flaw

CVE-2026-77782 Overview

CVE-2026-77782 is an information disclosure vulnerability in the Rank Math SEO plugin for WordPress. Versions prior to 1.0.277.1 fail to check whether a post is password protected before using its content to generate publicly accessible SEO metadata. Unauthenticated attackers can read the content of password-protected posts by requesting the SEO metadata associated with them. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve the contents of password-protected WordPress posts, bypassing the plugin's access control expectations.

Affected Products

Rank Math SEO WordPress plugin versions before 1.0.277.1
WordPress sites using Rank Math SEO with password-protected posts
Any WordPress installation exposing SEO metadata endpoints from the affected plugin

Discovery Timeline

2026-09-02 - CVE-2026-77782 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-77782

Vulnerability Analysis

The Rank Math SEO plugin generates SEO metadata such as Open Graph tags, meta descriptions, and schema markup from post content. For password-protected posts, the plugin does not verify the protection status before including the post body in this publicly rendered metadata. Attackers can request the metadata for a protected post and recover its content without supplying the password. The vulnerability affects confidentiality only. Integrity and availability of the target system remain unaffected.

Root Cause

The root cause is missing access control logic in the SEO metadata generation path. WordPress exposes a post_password field and helper functions such as post_password_required() to signal that a post's content must not be rendered to unauthenticated visitors. The affected Rank Math versions consume the raw post content when building SEO output without invoking this check. The result is a broken access control condition [CWE-200] where a security constraint enforced by WordPress core is bypassed by a downstream plugin.

Attack Vector

Exploitation requires no authentication, no user interaction, and no elevated privileges. An attacker sends a standard HTTP request to a page or endpoint that triggers Rank Math's SEO metadata rendering for a specific password-protected post. Protected post content appears in server-generated HTML metadata such as og:description, twitter:description, or JSON-LD schema blocks. Search engine caches and archive services may further amplify exposure by indexing the leaked metadata. For technical details, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-77782

Indicators of Compromise

Unauthenticated HTTP requests to URLs of password-protected posts returning non-empty og:description, twitter:description, or JSON-LD description fields
Search engine or archive snapshots containing excerpts from posts that should be gated behind a password
Presence of the Rank Math SEO plugin at a version earlier than 1.0.277.1 in the WordPress plugins directory

Detection Strategies

Audit installed Rank Math SEO plugin versions across managed WordPress sites and flag any release older than 1.0.277.1
Fetch each password-protected post URL as an unauthenticated client and inspect returned meta tags and schema blocks for leaked content
Review web server access logs for automated scanning patterns targeting known password-protected post slugs

Monitoring Recommendations

Alert on repeated anonymous access to URLs matching password-protected post IDs or slugs
Monitor outbound crawler and bot traffic accessing protected content endpoints
Track WordPress plugin update events and confirm Rank Math SEO reaches 1.0.277.1 or later on every site

How to Mitigate CVE-2026-77782

Immediate Actions Required

Update the Rank Math SEO plugin to version 1.0.277.1 or later on all WordPress installations
Inventory password-protected posts and assume their content may already be indexed or cached externally
Rotate or remove sensitive information previously stored in password-protected posts if confidentiality is required

Patch Information

The vendor fixed the issue in Rank Math SEO version 1.0.277.1 by adding a password-protection check before including post content in generated SEO metadata. Refer to the WPScan Vulnerability Report for the advisory reference.

Workarounds

Temporarily disable the Rank Math SEO plugin until it can be updated to a fixed version
Move highly sensitive content out of password-protected posts and into a properly access-controlled system
Request removal of cached copies of leaked metadata from search engines and archive services

bash

# Verify the installed Rank Math SEO plugin version via WP-CLI
wp plugin get seo-by-rank-math --field=version

# Update the plugin to the patched release
wp plugin update seo-by-rank-math --version=1.0.277.1