CVE-2026-77787: Rank Math SEO Privilege Escalation Flaw

CVE-2026-77787 Overview

CVE-2026-77787 is a missing authorization vulnerability [CWE-862] in the Rank Math SEO WordPress plugin before version 1.0.277. The plugin does not perform a capability check when bulk metadata updates target taxonomy terms. It also reuses the supplied object identifier across object types. Authenticated users with the Author role or above can modify SEO metadata of taxonomy terms they cannot edit. The same flaw allows overwriting the titles of posts owned by other users. The issue is limited in scope, requiring authenticated access and yielding only integrity impact on SEO metadata fields.

Critical Impact
Authenticated attackers at the Author level can tamper with SEO titles and taxonomy metadata belonging to other users, affecting search visibility and content integrity.

Affected Products

Rank Math SEO WordPress plugin versions prior to 1.0.277
WordPress sites granting Author-level or higher accounts to untrusted users
Multi-author WordPress deployments using Rank Math for SEO metadata management

Discovery Timeline

2026-09-02 - CVE-2026-77787 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-77787

Vulnerability Analysis

The vulnerability resides in the bulk metadata update handler of the Rank Math SEO plugin. The handler accepts an object identifier from the request but does not verify that the current user has the capability to edit the target object. WordPress distinguishes between post capabilities such as edit_post and taxonomy capabilities such as edit_term. The plugin conflates these object types and does not enforce the appropriate check before writing metadata.

Because the object identifier is reused across object types, a numeric ID supplied by an Author-level user can be interpreted against a taxonomy term or another user's post. The plugin then writes SEO metadata such as titles, descriptions, and canonical values to the target record. The result is an integrity issue affecting search-engine-facing content across the site.

Root Cause

The root cause is a missing authorization check [CWE-862] paired with ambiguous object handling. Any capability verification that exists applies to the acting user's own scope, not to the object identifier supplied in the request. The plugin trusts the client-supplied ID and does not call current_user_can() against the resolved object.

Attack Vector

The attack requires an authenticated session with Author privileges or higher. An attacker submits a crafted bulk metadata update request referencing a taxonomy term ID or a post ID belonging to another user. The plugin processes the request and overwrites the target metadata. No user interaction is required, and the exploit works over the network against the WordPress admin endpoint. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-77787

Indicators of Compromise

Unexpected changes to SEO titles, meta descriptions, or canonical URLs on posts and taxonomy terms
WordPress audit log entries showing bulk metadata updates initiated by Author-level accounts against objects they do not own
Post revisions or postmeta and termmeta writes correlated with Rank Math AJAX endpoints from low-privilege users

Detection Strategies

Audit postmeta and termmeta tables for changes to rank_math_title, rank_math_description, and related keys performed by non-owning users
Correlate WordPress user activity logs with admin-ajax requests targeting Rank Math bulk edit actions
Review web server access logs for POST requests to Rank Math endpoints originating from Author-level session cookies

Monitoring Recommendations

Enable a WordPress activity logging plugin to record metadata writes and attribute them to the initiating user
Alert on modifications to SEO metadata for high-value posts and category or tag terms
Track the installed version of Rank Math SEO across managed WordPress sites to confirm remediation

How to Mitigate CVE-2026-77787

Immediate Actions Required

Update the Rank Math SEO plugin to version 1.0.277 or later on all WordPress instances
Review Author-level and above accounts and remove or downgrade any that are no longer required
Audit recent SEO metadata changes and revert unauthorized modifications from backups or post revisions

Patch Information

The vendor addressed the issue in Rank Math SEO version 1.0.277 by adding capability checks to the bulk metadata update handler and correctly distinguishing between post and term object types. Administrators should apply the update through the WordPress plugin manager or WP-CLI. See the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Restrict Author-role assignments to trusted contributors until the plugin is updated
Temporarily disable the Rank Math SEO plugin on multi-author sites if patching is not immediately possible
Apply a web application firewall rule blocking Rank Math bulk edit AJAX actions from non-Editor sessions

bash

# Update Rank Math SEO via WP-CLI
wp plugin update seo-by-rank-math --version=1.0.277
wp plugin list --name=seo-by-rank-math --fields=name,status,version