Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability

Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...

CVE-2026-77788

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

CVE-2026-77783

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...

CVE-2026-77784

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-77787

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

CVE-2026-77785

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77782

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability

Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Non-Public Post Content Disclosure vulnerability

Author+ Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

EUVD-2026-69840

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

EUVD-2026-69839

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-77788

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , contains an authorization bypass vulnerability. The plugin fails to verify that a metadata row being updated belongs to the specific object the user is authorized to access. This flaw allows users with the Author role or higher to...

CVE-2026-77785 Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77785

The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , is vulnerable to a content disclosure flaw because it fails to verify if a requesting user has permission to access specific posts. This allows users with the Author role and above to view the title, body, and metadata of non-publ...

CVE-2026-77784 Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

EUVD-2026-69841

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite vulnerability

Author+ Arbitrary Post and User Metadata Overwrite vulnerability discovered by Usama Arshad in WordPress Plugin Rank Math SEO versions 1.0.277...

CVE-2026-77785 Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

WordPress Rank Math SEO plugin < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability

Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...