Rank Math SEO CVE-2026-77784

Exploitation requires an authenticated WordPress session with at least the Author role (Author, Editor, or Administrator). The Rank Math SEO plugin must be installed and active on the target site. The attacker must supply a valid object ID for the target post, taxonomy term, or user profile - IDs are typically enumerable from public post URLs or the WordPress REST API without additional privilege. No special server configuration or non-default plugin settings are required beyond standard plugin activation. Limiting factors: a valid authenticated session with Author role or above is mandatory (no unauthenticated exploitation path); impact is strictly confined to SEO metadata integrity with no ability to read private data, execute code, or cause denial of service.

The NVD CVSS 2.7 base score (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) accurately captures the limited integrity-only impact but the PR:H metric likely overstates the privilege required - WordPress Author is a standard content-contributor role far below administrative level and is conventionally mapped to PR:L in WordPress ecosystem security assessments, which would raise the calculated score modestly. A publicly available proof-of-concept reduces the technical barrier to exploitation, and even a mid-sized content operation in swidnica hosting a news or municipal WordPress portal routinely grants Author access to dozens of contributors, making the realistic attacker pool broader than the PR:H label suggests. No EPSS score or KEV listing was provided; active exploitation in the wild is not confirmed. The business impact is confined to SEO integrity - no code execution, data exfiltration, or service disruption is possible - but deliberate de-indexing of a competitor's or colleague's content represents a tangible operational risk in publishing and e-commerce contexts. Overall, this warrants routine patching rather than emergency response.

An authenticated WordPress user with Author role enumerates another author's post IDs (trivially available from public URLs or the WordPress REST API), then submits a crafted metadata update request to the Rank Math SEO plugin's object-update endpoint specifying the victim's post ID. The plugin applies the noindex and sitemap-exclusion flags without verifying ownership, causing the victim's content to be removed from the site's sitemap and eventually de-indexed by search engines. A publicly available proof-of-concept demonstrates this technique.