Security Alert Summary
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata. This allows users with the Author role and above to modify SEO metadata for content, taxonomy terms, and user profiles they do not own, and to remove other users\’ content from the site\’s sitemap and search engine index.
CVE Details
- CVE ID: CVE-2026-77784
- Affected plugin: Rank Math SEO
- Affected versions: Versions before 1.0.277 (less than 1.0.277)
- Published: September 2, 2026 at 6:17:17 AM UTC
- Last modified: September 2, 2026 at 11:17:20 AM UTC
- CVSS v3.1 base score: 2.7
- CVSS v3.1 severity: LOW
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction:
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: HIGH
- User Interaction: NONE
- Scope: UNCHANGED
- Primary impact:
- Confidentiality: NONE
- Integrity: LOW
- Availability: NONE
- Weakness (CWE): CWE-639
Technical Details
The plugin fails to verify whether the requesting user is authorized to edit the specific object before updating its SEO indexing metadata. As described in the vulnerability report, users with the Author role and above can alter SEO indexing metadata for objects they do not own, including posts, taxonomy terms, and user profiles. The same weakness allows those users to remove other users\’ content from the site\’s sitemap and search engine index.
The issue is rooted in missing or insufficient permission checks when the plugin updates indexing-related metadata. No specific functions or REST API endpoints are named in the provided data, so the description focuses on the absence of ownership or capability verification prior to modifying indexing metadata.
Impact is limited to integrity of SEO and indexing metadata. There is no reported direct confidentiality or availability impact in the provided data.
How This Could Impact Your Website
Consider a site where the owner manages publication but delegates content creation to internal staff and external contributors. An Author-account user could change indexing settings on posts or user profiles they do not own, which might remove colleagues\’ articles from sitemaps or prevent pages from being indexed. That could lead to unintentional removal of content from search results and make internal email addresses or profile information more exposed to manipulation in ways that increase targeted phishing or social engineering risk.
For example, an external contractor with Author-level access could alter the indexing metadata of another editor\’s post so it no longer appears in the sitemap, reducing its visibility to search engines and readers. While this does not give full site control, it does affect content discoverability and the integrity of published metadata.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and Authors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and change logs for unusual metadata updates or sitemap removals.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
