All vulnerabilities
CVE-2026-77786
Medium
CVSS 4.9
Broken access control in Rank Math SEO
| Vendor | Rank Math |
|---|---|
| Product | Rank Math SEO |
| Affected versions | < 1.0.277 |
| Weakness | CWE-863 |
| Reported | 2026-08-27 |
| Disclosed | 2026-08-27 |
| Status | Published |
Discovered and responsibly disclosed a Broken Access Control vulnerability (CWE‑863, Incorrect Authorization) in Rank Math SEO — one of the most widely deployed WordPress SEO plugins, with millions of active installations. An Editor‑level user could modify core site SEO settings via the fix-site-seo ability without proper capability checks. Reported through WPScan (submission #45947); fixed in version 1.0.277 with credit in the official changelog. CVSS 4.9 (Medium).
Related disclosures
Low
Rank Math SEO - Author+ Non-Public Post Content Disclosure via Abilities API
Low
Rank Math SEO - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk
Low
Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
Low
The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
View all