Rank Math SEO CVE-2026-77785

Exploitation requires a valid WordPress account with at minimum the Author role (Contributor, Subscriber, and unauthenticated users are not affected). The attacker must know or enumerate a valid post ID belonging to another user's non-public post (draft, private, or pending review). No special server-side configuration is needed beyond having the Rank Math SEO plugin installed and active on versions before 1.0.277. Limiting factors: requires authenticated session (Author+), requires knowledge of a target post ID, and impact is read-only - no write or delete capability is exposed.

The provided CVSS score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) understates real-world risk because PR:H implies administrator-level privilege, whereas the Author role in WordPress is a low-privilege editorial role (PR:L is more appropriate). Adjusting to PR:L yields a score closer to 4.3. Impact is limited to confidentiality (C:L) of non-public post content - no integrity or availability risk. A publicly available exploit lowers the exploitation bar. No EPSS data was provided; no KEV listing exists. For sites where authors produce sensitive unpublished content (e.g., embargoed journalism, product roadmaps, internal drafts), the real-world risk is meaningfully higher than the raw CVSS score suggests. For sites where authors only manage their own public content, risk is negligible. The patch is available and straightforward to apply.

An authenticated WordPress user with the Author role crafts an HTTP request to a Rank Math SEO endpoint, supplying the post ID of another user's unpublished draft or private post. Because the plugin does not validate read permissions against that post ID, the endpoint returns the post's title, body content, and SEO metadata. A publicly available exploit from WPScan details the specific request structure, making this trivially reproducible by any Author-level account holder.