Rank Math SEO EUVD-2026-69837

The target WordPress site must have the Rank Math SEO plugin installed and active at a version below 1.0.277.1. At least one post on the site must be configured as password-protected (using WordPress's native post password feature) and must contain content that Rank Math uses to generate SEO metadata. No authentication is required; no special network position or configuration is needed beyond HTTP access to the site. Sites that do not use WordPress's password-protected post feature are not affected.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is well-calibrated for this vulnerability. The attack vector is fully remote with no prerequisites, but the confidentiality impact is limited - only post body content is exposed, and only for posts the site owner chose to protect with a password rather than keep private. Real-world risk is bounded by whether the affected WordPress site actually uses password-protected posts for genuinely sensitive material; sites that use the feature for obscurity (e.g., draft sharing with a link) face less meaningful exposure than those that use it for access control to sensitive content. A publicly available WPScan PoC lowers the exploitation bar significantly, making this a credible threat for any site running the vulnerable plugin range with password-protected posts. EPSS data is not provided in this input, but given the widespread deployment of Rank Math SEO and the zero-barrier exploitation path, prioritizing the patch is advisable for any operator using password protection as a meaningful access control.

An unauthenticated attacker identifies a WordPress site running Rank Math SEO with password-protected posts - discoverable by observing post_password hints in page HTML or by brute-forcing post slugs. The attacker requests the post URL directly and inspects the rendered SEO metadata (Open Graph tags or JSON-LD in the page <head>), which contains the full body content of the protected post despite the password gate on the visible content. A WPScan PoC documents the exact technique.