CVE-2026-77783 Overview
CVE-2026-77783 is an information disclosure vulnerability in the Rank Math SEO WordPress plugin versions before 1.0.277. The plugin renders schema markup on the front end without verifying whether the underlying post is publicly viewable. Unauthenticated visitors can retrieve the schema and associated content of draft, pending, private, scheduled, and password-protected posts. The flaw is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated attackers can disclose content and metadata from non-public WordPress posts through the schema rendering endpoint.
Affected Products
- Rank Math SEO WordPress plugin versions prior to 1.0.277
Discovery Timeline
- 2026-09-02 - CVE-2026-77783 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77783
Vulnerability Analysis
The Rank Math SEO plugin generates structured schema data for WordPress posts to improve search engine visibility. The plugin exposes this schema through front-end endpoints without checking the visibility status of the source post. An unauthenticated visitor can request the schema for posts in draft, pending, private, future (scheduled), and password-protected states.
The attacker receives structured data that includes titles, excerpts, and other post fields intended to remain confidential until publication. This bypasses the WordPress access control model that normally restricts non-public content to authorized users.
Root Cause
The root cause is a missing authorization check on the schema rendering path. The plugin retrieves post data based on a user-supplied identifier and returns the schema without validating post_status against the requester's capabilities. This matches the [CWE-639] pattern of authorization bypass through user-controlled keys.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker enumerates or guesses post identifiers and requests the schema endpoint for each. The endpoint responds with schema payloads for non-public posts, disclosing content that WordPress would otherwise restrict. Refer to the WPScan Vulnerability Report for technical details on the affected endpoint.
Detection Methods for CVE-2026-77783
Indicators of Compromise
- Unusual volumes of front-end requests referencing sequential post IDs from a single source address
- Access log entries showing schema retrieval requests for post IDs that correspond to non-public posts in the database
- Anonymous user agents fetching pages that return schema markup for posts with post_status values of draft, pending, private, or future
Detection Strategies
- Correlate WordPress access logs with the wp_posts table to identify successful schema responses for posts that are not publish status
- Review web server logs for parameter-based enumeration patterns targeting Rank Math schema output
- Deploy web application firewall rules that inspect responses containing application/ld+json schema for non-public post identifiers
Monitoring Recommendations
- Track the installed Rank Math SEO version across WordPress fleets and alert on installations below 1.0.277
- Monitor outbound response payloads from WordPress hosts for schema content matching unpublished post titles
- Baseline anonymous traffic to schema-emitting URLs and alert on sudden spikes
How to Mitigate CVE-2026-77783
Immediate Actions Required
- Update the Rank Math SEO plugin to version 1.0.277 or later on all WordPress sites
- Audit unpublished posts for sensitive content that may have been exposed while the vulnerable version was active
- Rotate or update any credentials, embargoed data, or draft material referenced in non-public posts
Patch Information
The vendor addressed CVE-2026-77783 in Rank Math SEO version 1.0.277. The fix adds a visibility check that confirms the requested post is publicly viewable before rendering its schema. Details are available in the WPScan Vulnerability Report.
Workarounds
- Temporarily disable the Rank Math SEO plugin on affected sites until the update to 1.0.277 is applied
- Restrict access to schema-emitting endpoints with a web application firewall rule that blocks anonymous requests referencing non-published post IDs
- Move sensitive drafts to a staging environment that is not reachable from the public internet until patching is complete
# Update Rank Math SEO using WP-CLI
wp plugin update seo-by-rank-math --version=1.0.277
wp plugin list --name=seo-by-rank-math --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
