Security Alert Summary
The Rank Math SEO WordPress plugin (versions before 1.0.277) does not verify that the requesting user is permitted to read a specific post before returning its content and SEO metadata. As a result, users with the Author role and above can read the title, body, and metadata of other users’ non-public posts.
CVE Details
- CVE ID: CVE-2026-77785
- Affected component: Rank Math SEO WordPress plugin
- Affected versions: Versions before 1.0.277 (reported affected version: 1.0.272, less than 1.0.277)
- Published: September 2, 2026 at 06:17:17 AM UTC
- Last Modified: September 2, 2026 at 11:17:21 AM UTC
- CVSS v3.1: Base score 2.7, Severity LOW, Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Authentication / Privileges / User interaction: Privileges required: HIGH (CVSS), User interaction: NONE. The description notes the issue allows users with an Author role and above to read non-public posts.
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-639
Technical Details
The plugin fails to verify read permission for the specific post referenced in a request before returning that post’s content and SEO metadata. Because the access control check is missing or insufficient, authenticated users who meet the Author role threshold can retrieve title, body, and metadata for other users’ non-public posts. The issue stems from returning post content and associated SEO metadata without ensuring the requesting user has permission to view that post.
How This Could Impact Your Website
Consider a site with a site owner, several internal staff members (editors and authors), and external contractors who contribute content. An author or contractor who should only access their own drafts could use the affected plugin behavior to read non-public posts created by other users. That could reveal drafts, editorial notes, or SEO metadata that contain internal details. In practice this may lead to exposure of internal user email addresses or other metadata stored with posts, and it can increase the risk of targeted phishing or social engineering against staff whose information is exposed.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and authors who do not need access to other users posts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and audit logs for unusual behavior, such as authors accessing posts they do not own.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
