Vulnerability · Published Aug 29, 2026 · Assigned by WPScan
CVE-2026-77786Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability
Medium 4.9
In plain English
A medium-severity incorrect authorization in Rank Math SEO from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.3%top 73.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Rank Math SEO | 1.0.271 – before 1.0.277 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
References
- https://wpscan.com/vulnerability/b0f3dfdb-9f0a-418c-9ce5-6a2b2b1f1b49/ exploit, vdb-entry, technical-description