Security Alert Summary
The Rank Math SEO WordPress plugin before version 1.0.277.1 fails to check whether a post is password protected before using its content to build publicly generated SEO metadata. As a result, unauthenticated users can read the content of password-protected posts via the generated metadata.
CVE Details
- CVE ID: CVE-2026-77782
- Affected component: Rank Math SEO WordPress plugin
- Affected versions: Versions less than 1.0.277.1
- Published: September 2, 2026 at 6:17:17 AM UTC
- Last modified: September 2, 2026 at 11:17:20 AM UTC
- CVSS v3.1 base score: 5.3
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: NONE; user interaction: NONE; attack vector: NETWORK; attack complexity: LOW
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- Weakness: CWE-200 (Exposure of Sensitive Information)
Technical Details
The plugin generates public SEO metadata using post content without first verifying whether a post is password protected. Because the protection check is omitted, the publicly generated metadata can include content extracted from password-protected posts. This allows unauthenticated users to obtain content that site authors intended to keep restricted.
The issue is a missing access or visibility check in the metadata generation path. The description indicates the vulnerability is limited to disclosure of post content via publicly produced SEO fields; there is no indication in the provided data of integrity or availability impacts.
How This Could Impact Your Website
Consider a small site where a site owner creates private draft posts or where internal staff and external contractors contribute content that is marked as password protected. If Rank Math SEO generates public metadata from those posts without verifying protection, external visitors could read excerpts or full content that was intended to remain restricted. That could expose business-sensitive information or internal contact details.
Practical consequences include exposure of internal user email addresses or other private data embedded in posts, and an increased risk of targeted phishing or social engineering against staff or contractors who appear in exposed content. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to content access or metadata generation.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
