WordPress Plugin Vulnerabilities

Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

Description

The plugin does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts.

Proof of Concept

Affects Plugins

Plugin icon
seo-by-rank-math
Fixed in 1.0.277

References

CVE
CVE-2026-77785

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Mohammed Abd Alrahman
Submitter
Mohammed Abd Alrahman
Submitter website
https://mohmadev.com/
Verified
Yes
WPVDB ID
7cf8aa8a-7ac2-4e70-a7af-3f23e4ac1824

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2024-06-28
Title
Page and Post Clone < 6.1 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure
Published
2022-04-21
Title
WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR
Published
2026-08-05
Title
CubeWP Framework <= 1.1.31 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR
Published
2026-07-30
Title
Fluent Forms < 6.2.9 - Unauthenticated Payment Receipt Disclosure via IDOR
Published
2025-04-07
Title
Streamit < 4.0.3 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover