CVE-2026-77784: Rank Math SEO Authorization Vulnerability

CVE-2026-77784 Overview

CVE-2026-77784 is a broken access control vulnerability in the Rank Math SEO WordPress plugin before version 1.0.277. The plugin fails to verify that a user is authorized to edit the object being modified before updating its SEO indexing metadata. Authenticated users with the Author role or higher can alter SEO metadata on content, taxonomy terms, and user profiles they do not own. Attackers can remove other users' content from the site's sitemap and search engine index. The issue is classified under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact

Author-level users can manipulate SEO metadata on objects they do not own, removing legitimate content from search engine visibility.

Affected Products

• Rank Math SEO WordPress plugin versions before 1.0.277
• WordPress sites permitting Author-role or higher accounts
• Sites relying on Rank Math for sitemap and indexing management

Discovery Timeline

• 2026-09-02 - CVE-2026-77784 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-77784

Vulnerability Analysis

The Rank Math SEO plugin exposes endpoints that update SEO indexing metadata for WordPress objects. These objects include posts, taxonomy terms, and user profiles. The plugin authenticates the request but does not confirm that the requesting user owns or has edit rights to the target object. Any user with the Author role or higher can therefore submit requests that modify metadata on resources belonging to other users.

Root Cause

The root cause is a missing authorization check on the object identifier supplied in the update request. The plugin treats a valid session with Author-level capabilities as sufficient to modify any object's SEO metadata. This maps to [CWE-639], where authorization decisions depend on user-controlled keys without verifying ownership. The vulnerability affects content, taxonomy terms, and user profiles alike.

Attack Vector

An authenticated attacker with Author permissions sends a crafted request targeting an object ID they do not own. The plugin accepts the object ID and updates the associated SEO indexing fields, such as the noindex directive. Setting noindex on another author's posts or terms removes those items from the site's sitemap. Search engines subsequently drop the affected URLs from their index, causing loss of organic traffic and visibility for the targeted content.

No verified proof-of-concept code is available. Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-77784

Indicators of Compromise

• Unexpected changes to noindex, nofollow, or canonical URL settings on posts owned by other users
• Author-role accounts issuing requests to Rank Math REST endpoints referencing object IDs outside their authorship
• Sudden drops in indexed pages reported by Google Search Console without corresponding content changes
• Sitemap entries missing for content that remains published on the site

Detection Strategies

• Audit the WordPress postmeta, termmeta, and usermeta tables for Rank Math keys such as rank_math_robots modified by users who are not the object owner
• Review web server access logs for POST or PUT requests from Author accounts to Rank Math admin-ajax or REST routes with mismatched object ownership
• Correlate plugin metadata changes with the acting user ID captured in WordPress activity logs

Monitoring Recommendations

• Enable a WordPress audit logging plugin to record every SEO metadata change with actor, target, and timestamp
• Monitor Google Search Console coverage reports for unexplained deindexing events
• Alert on Author-role accounts performing metadata updates on objects they did not author

How to Mitigate CVE-2026-77784

Immediate Actions Required

• Upgrade the Rank Math SEO plugin to version 1.0.277 or later on all WordPress instances
• Review recent SEO metadata changes and revert unauthorized modifications on content, terms, and profiles
• Audit Author-role and higher accounts for signs of misuse or compromise

Patch Information

The vendor fixed the missing authorization check in Rank Math SEO version 1.0.277. Consult the WPScan Vulnerability Report for advisory details and confirm the plugin version through the WordPress admin dashboard after updating.

Workarounds

• Restrict Author and Contributor role assignments to trusted users until patching is complete
• Temporarily deactivate the Rank Math SEO plugin if immediate patching is not feasible on high-value sites
• Enforce multi-factor authentication for all WordPress accounts holding Author role or higher to limit account takeover risk

# Update Rank Math SEO via WP-CLI
wp plugin update seo-by-rank-math --version=1.0.277
wp plugin get seo-by-rank-math --field=version