CVE-2026-77787 in Rank Math SEO Plugin
Summary
by MITRE • 09/02/2026
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Rank Math SEO versions prior to 1.0.277 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem, specifically affecting how bulk metadata updates are processed for taxonomy terms. This flaw stems from an insufficient verification of user permissions during administrative operations that involve modifying term meta data. In standard WordPress architecture, actions such as editing or deleting content should be gated by specific capability checks to ensure that only users with appropriate privileges can alter the associated metadata. However, in this instance, the plugin fails to validate whether the authenticated user possesses the necessary capabilities before executing bulk updates on taxonomy terms. This oversight allows any logged-in user with an Author role or higher to bypass intended restrictions and modify SEO-related metadata for taxonomies they do not own or have permission to edit.
Beyond the unauthorized modification of term metadata, the vulnerability exhibits a more severe characteristic known as object identifier reuse across different object types. The underlying code logic incorrectly assumes that the provided object identifier corresponds exclusively to the expected data type during bulk operations. This lack of strict type validation enables an attacker to supply identifiers belonging to one entity type while targeting another. Consequently, this misalignment allows malicious actors to overwrite titles and other metadata for posts authored by different users. By exploiting this cross-object manipulation, a user with Author privileges can effectively alter the SEO properties of content they do not own, potentially leading to search engine optimization hijacking or defacement of site appearance through title tampering.
From an operational impact perspective, this vulnerability compromises both data integrity and confidentiality within the WordPress environment. Attackers can manipulate how specific pages appear in search results by altering meta titles and descriptions for terms they should not control. Furthermore, the ability to overwrite post titles belonging to other users introduces significant risks regarding content authenticity and reputation management. In multi-author sites or enterprise environments where multiple contributors manage content, this flaw undermines trust among authors and administrators. It also opens avenues for further exploitation if combined with other vulnerabilities, such as cross-site scripting stored in metadata fields that are later rendered without proper sanitization by the theme or plugin frontend code.
This issue aligns closely with CWE-284 Improper Access Control, specifically reflecting failures in authorization checks during bulk operations and object reference manipulation. It also maps to MITRE ATT&CK techniques related to privilege escalation and lateral movement within web applications, as it allows lower-privileged users to perform actions reserved for higher privileges or administrators. The lack of strict input validation regarding object types further correlates with CWE-20 Improper Input Validation, where the system fails to verify that inputs match expected constraints before processing them.
To mitigate this vulnerability, site administrators must immediately update Rank Math SEO to version 1.0.277 or later, which addresses these access control and input validation flaws. Until an upgrade is feasible, implementing additional security layers such as Web Application Firewalls can help detect anomalous bulk request patterns indicative of exploitation attempts. Additionally, enforcing strict role-based access controls at the server level and auditing user permissions regularly can reduce the attack surface. Developers should also ensure that all future custom code or plugins adhere to WordPress coding standards by rigorously checking capabilities using functions like current_user_can before processing any metadata updates, ensuring that object IDs are validated against their expected types to prevent cross-object manipulation attacks.