CVE-2026-77785 — Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

CVE-2026-77785

Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API PUBLISHED

Description (CNA)

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts.

Affected (CNA)

Vendor / product	Versions
Unknown / Rank Math SEO	affected 1.0.272 before 1.0.277

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7cf8aa8a-7ac2-4e70-a7af-3f23e4ac1824/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.