CVE-2026-77785 Overview
The Rank Math SEO WordPress plugin contains a broken access control flaw in versions prior to 1.0.277. The plugin fails to verify whether the requesting user is authorized to read a specific post before returning its content and SEO metadata. Authenticated users holding the Author role or higher can retrieve the title, body, and metadata of non-public posts belonging to other users. The issue is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated WordPress users with Author-level access or above can read draft, pending, and private posts owned by other authors, exposing unpublished content and associated SEO metadata.
Affected Products
- Rank Math SEO WordPress plugin versions before 1.0.277
- WordPress installations exposing the Author role or higher to untrusted contributors
- Multi-author WordPress sites relying on Rank Math for SEO management
Discovery Timeline
- 2026-09-02 - CVE-2026-77785 published to the National Vulnerability Database
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77785
Vulnerability Analysis
The flaw is an Insecure Direct Object Reference (IDOR) in a Rank Math SEO endpoint that returns post content and SEO metadata. The plugin trusts the post identifier supplied in the request and returns the referenced post without checking whether the caller has permission to view it. WordPress normally restricts access to non-public post statuses (draft, pending, private, future) based on ownership and capability. Rank Math bypasses those checks for the affected endpoint, so any authenticated user meeting the minimum role requirement can enumerate post IDs and retrieve content they should not see.
Root Cause
The root cause is a missing authorization check on the post identifier passed to the plugin's data-retrieval handler. The code performs an authentication check and a role check, but does not call a capability check such as current_user_can('read_post', $post_id) or verify post ownership before returning the post object and its SEO metadata. This aligns with [CWE-639], where authorization is enforced on the user's session but not on the user-controlled key identifying the resource.
Attack Vector
Exploitation requires an authenticated session with the Author role or above and network access to the WordPress site. The attacker iterates post IDs against the vulnerable Rank Math endpoint. For each ID, the server returns the post title, body, and SEO metadata regardless of the post's status or owner. No user interaction from the victim is required, and the attack leaves standard authenticated request traces in access logs. Refer to the WPScan Vulnerability Report for further technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-77785
Indicators of Compromise
- Authenticated requests from Author-role accounts to Rank Math REST or AJAX endpoints referencing post IDs the user does not own.
- Sequential or scripted enumeration of post IDs in access logs originating from a small number of authenticated sessions.
- Unexpected retrieval of draft, pending, or private post content by non-editor accounts.
Detection Strategies
- Correlate WordPress user roles with the post IDs each session requests through Rank Math endpoints and flag cross-ownership access.
- Alert on high-volume, low-interval requests to Rank Math plugin endpoints from a single authenticated user.
- Compare returned post statuses in application logs against the caller's capability set.
Monitoring Recommendations
- Enable WordPress request logging and forward it, along with plugin-level logs, to a central analytics platform for retention and query.
- Monitor the installed Rank Math version across sites and alert when any instance runs a version earlier than 1.0.277.
- Track new Author-role account creation and correlate with subsequent access to Rank Math endpoints.
How to Mitigate CVE-2026-77785
Immediate Actions Required
- Update the Rank Math SEO plugin to version 1.0.277 or later on all WordPress sites.
- Audit accounts holding the Author role or higher and remove any that are unused or unnecessary.
- Review recent access logs for enumeration patterns against Rank Math endpoints prior to patching.
Patch Information
The vendor addressed the missing authorization check in Rank Math SEO version 1.0.277. Site administrators should apply the update through the WordPress plugin manager or WP-CLI. Details of the fix are referenced in the WPScan Vulnerability Report.
Workarounds
- Temporarily restrict the Author role to trusted users only until the patch is applied.
- Deactivate the Rank Math SEO plugin on sites where immediate patching is not feasible and non-public post confidentiality is required.
- Use a web application firewall rule to block or rate-limit requests to affected Rank Math endpoints from non-editor sessions.
# Update Rank Math SEO via WP-CLI
wp plugin update seo-by-rank-math --version=1.0.277
wp plugin list --name=seo-by-rank-math --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
