Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2026-77785

Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

Description

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Rank Math SEO

Default version status: unaffected

  • 1.0.272 to < 1.0.277affected

References