CVE-2026-77788: Unknown Rank Math Seo

Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days.

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.

Affected products

• Unknown Rank Math Seo: from 1.0.48, before 1.0.277 (fixed in 1.0.277)

Published 2026-09-02. Last modified 2026-09-03.