CVE-2026-77783 Rank Math CVE debrief

Who should care

Defenders of WordPress installations using the Rank Math SEO plugin should assess exposure and verify remediation status for version 1.0.277 or later. This includes reviewing compensating controls for exposed systems, checking relevant monitoring, detection, and logs for exposed assets, and tracking exceptions and retesting remediated assets.

Why it matters

CVE-2026-77783 allows unauthenticated visitors to disclose schema and associated content of draft, pending, private, scheduled and password-protected posts in Rank Math SEO WordPress plugin versions prior to 1.0.277.

• Potential disclosure of sensitive post content.
• Possible impact on content confidentiality.
• Requires verification of vendor remediation.

Technical summary

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts. This vulnerability has a CVSS score of 3.7 and is considered LOW severity. Defenders should assess exposure and verify remediation status for version 1.0.277 or later. The CVE record was published on 2026-09-02T06:17:17.567Z and has not been modified since then.

Defensive priority

Assess exposure of Rank Math SEO WordPress plugin versions prior to 1.0.277.

Recommended defensive actions

• Inventory Rank Math SEO WordPress plugin versions and assess exposure.
• Verify vendor remediation status for version 1.0.277 or later.
• Monitor for potential unauthorized schema disclosures.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts. Evidence is limited to public CVE and NVD records. Defenders should verify vendor remediation status for version 1.0.277 or later and monitor for potential unauthorized schema disclosures.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.