CVE-2026-77788 — Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

CVE-2026-77788

Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas PUBLISHED

Description (CNA)

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.

Affected (CNA)

Vendor / product	Versions
Unknown / Rank Math SEO	affected 1.0.48 before 1.0.277

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c02511a0-9c8b-44cd-b25f-e95cf5f9fef3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.