Vulnerability · Published Sep 2, 2026 · Assigned by WPScan
CVE-2026-77787Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk
Low 2.7
In plain English
A low-severity missing authorization in Rank Math SEO from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Rank Math SEO | 1.0.255 – before 1.0.277 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/849a4859-e10e-49e6-9c38-265b902507b8/ exploit, vdb-entry, technical-description