CVE-2026-77783 Rank Math CVE debrief

Who should care

Users of Rank Math SEO WordPress plugin version before 1.0.277 should review and apply patches. Security teams should monitor for potential exploitation attempts and verify the public viewability of posts rendered by the plugin. Additionally, operators of WordPress sites using the affected plugin version should assess their exposure and take appropriate defensive measures. Vulnerability management and security teams responsible for WordPress deployments should prioritize patching and review system logs for unusual activity.

Technical summary

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable. This vulnerability allows unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled, and password-protected posts. The issue arises from the plugin's failure to implement proper access controls on schema rendering, potentially leading to unintended information disclosure. Users of the plugin should review and apply patches to mitigate this vulnerability.

Defensive priority

Low-priority defensive review recommended due to limited CVSS score of 3.7 and lack of known ransomware campaign use.

Recommended defensive actions

• Review and apply vendor patches for Rank Math SEO WordPress plugin version 1.0.277 or later.
• Verify that the post whose schema is rendered on the front end is publicly viewable.
• Monitor for potential exploitation attempts.
• Perform an inventory of affected systems and prioritize patching based on criticality.
• Implement compensating controls such as restricting access to sensitive posts.
• Track changes to the plugin and related security advisories.
• Review system logs for unusual activity related to post schema disclosure.

Evidence notes

The evidence provided is limited, primarily based on official CVE and NVD records. The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable. This oversight allows unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled, and password-protected posts. Defenders should verify the public viewability of posts rendered by the plugin and review the schema content for sensitive information. Additional details about the vulnerability's impact and exploitation are needed for a comprehensive assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.