Vulnerability · Published Sep 2, 2026 · Assigned by WPScan

CVE-2026-77784Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

Low 2.7

In plain English

A low-severity authorization bypass via user-controlled key in Rank Math SEO from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Rank Math SEO	0 – before 1.0.277

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/7a6ad8c5-eb7e-4201-8597-479e77863985/ exploit, vdb-entry, technical-description