CVE-2026-77786 Medium CVSS 4.9

Broken access control in Rank Math SEO

Vendor	Rank Math
Product	Rank Math SEO
Affected versions	< 1.0.277
Weakness	CWE-863
Reported	2026-08-27
Disclosed	2026-08-27
Status	Published

Discovered and responsibly disclosed a Broken Access Control vulnerability (CWE‑863, Incorrect Authorization) in Rank Math SEO — one of the most widely deployed WordPress SEO plugins, with millions of active installations. An Editor‑level user could modify core site SEO settings via the fix-site-seo ability without proper capability checks. Reported through WPScan (submission #45947); fixed in version 1.0.277 with credit in the official changelog. CVSS 4.9 (Medium).

Advisory

Related disclosures

Low Rank Math SEO - Author+ Non-Public Post Content Disclosure via Abilities API CVE-2026-77785 Low Rank Math SEO - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk CVE-2026-77787 High Simple Shopping Cart < 5.3.3 – Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient CVE-2026-104641 Medium Elementor < 4.3.5 – Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass CVE-2026-81813

View all