Rank Math SEO CVE-2026-77787

Exploitation requires an authenticated WordPress session with at minimum the Author role on the target installation - Subscriber and Contributor roles are not affected. The Rank Math SEO plugin must be installed, active, and at a version prior to 1.0.277. The attacker must be able to submit requests to the plugin's bulk metadata update endpoint. No special server configuration or non-default WordPress settings are required beyond the plugin being active. What limits exploitation: no unauthenticated path exists (a valid Author-or-higher account is mandatory), impact is restricted to integrity (SEO metadata and post titles only - no code execution, credential theft, or availability impact), and sites that do not grant Author access to untrusted users face negligible practical risk.

The reported CVSS 3.1 score of 2.7 uses PR:H (high privileges), but the vulnerability description explicitly states exploitation is possible with the Author role, which is a low-privilege WordPress role - this is a scoring discrepancy that understates real-world risk. With PR:L, the score would be approximately 5.4 (Medium). Impact is bounded to integrity (I:L): attackers can manipulate SEO metadata (titles, descriptions) and overwrite other users' post titles, enabling SEO poisoning, search-result manipulation, or content defacement - meaningful business risk for content-heavy sites, though no code execution or data exfiltration is possible. A public exploit exists per WPScan, but no CISA KEV listing is present and no EPSS data was provided, suggesting exploitation has not been observed at scale. Practical risk is highest on multi-tenant WordPress sites (agencies, SaaS platforms, guest blogging sites) where untrusted Author-role accounts may exist.

An attacker registers or compromises an Author-level WordPress account on a target site running Rank Math SEO before v1.0.277. They invoke the plugin's bulk metadata update endpoint, supplying object identifiers corresponding to taxonomy terms or posts they do not own, and the missing capability check allows the changes through. The attacker overwrites SEO titles or meta descriptions on high-traffic pages to inject misleading content, degrade competitor rankings within the site, or redirect organic search traffic. A public exploit is available via WPScan.