Rank Math SEO CVE-2026-77786

Exploitation requires a valid WordPress Editor-role account (or any non-administrator role with plugin access) on the target site - unauthenticated attackers cannot exploit this vulnerability. The Rank Math SEO plugin must be installed, active, and running a version below 1.0.277. Multi-author WordPress sites that delegate Editor access to contributors, freelancers, or guest users represent the primary at-risk deployment pattern. Exploitation is bounded to integrity impact (unauthorized modification of core WordPress settings); there is no confidentiality or availability component, and the attacker cannot read sensitive data or take the site offline through this vulnerability alone. The requirement for Editor-level credentials meaningfully limits opportunistic mass exploitation compared to unauthenticated flaws.

The CVSS 3.1 score of 4.9 (Medium) is appropriate: PR:H reflects that an Editor-role account is required, AC:L confirms the exploit is trivial to execute once credentials are held, and I:H captures the high integrity impact of unauthorized core settings modification. The EPSS score of 0.13% at the 3rd percentile signals very low near-term exploitation probability, consistent with the authentication barrier - mass exploitation requires pre-existing or compromised Editor accounts rather than unauthenticated access. However, a publicly available exploit via WPScan significantly lowers the technical bar for any attacker who does hold or can obtain an Editor credential. Rank Math SEO is widely deployed across multi-author WordPress sites where Editor access is routinely granted to contributors, freelancers, and guest authors, meaning the real-world credential surface is broader than the PR:H metric alone implies. The vulnerability is not listed in CISA KEV, so active in-the-wild exploitation is not confirmed at time of analysis. Overall, the combination of a public exploit and widespread Editor-role delegation makes this a meaningful priority update for any multi-author site, even though the raw CVSS and EPSS figures appear modest.

An attacker with a legitimate or compromised Editor-role account on a target WordPress site running Rank Math SEO below 1.0.277 sends a crafted authenticated request to the plugin's automated SEO fix endpoint. Because the plugin does not verify the caller's WordPress capabilities, the request executes and applies changes to site-wide administrator-reserved settings such as site URL, default role, or other manage_options-gated configuration. A public proof-of-concept is available via WPScan entry b0f3dfdb-9f0a-418c-9ce5-6a2b2b1f1b49, making this straightforward to replicate.