CVE-2026-77784 Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as
Authors can modify SEO metadata on content they do not own, potentially removing other users' content from search engine indexes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77784?
CVE-2026-77784 is a low-severity missing authorization vulnerability in Unknown Rank Math SEO, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.
Weakness: CWE-639
Which versions are affected by CVE-2026-77784?
How do I fix CVE-2026-77784?
No fix has been published for CVE-2026-77784 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-77784 being exploited?
There is no known exploitation of CVE-2026-77784 in the wild and no public exploit code.
Sources
Also known as GHSA-rh8h-jgfm-8mq4.