WordPress Plugin Vulnerabilities

Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

Description

The plugin does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.

Proof of Concept

Affects Plugins

Plugin icon
seo-by-rank-math
Fixed in 1.0.277

References

CVE
CVE-2026-77788

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.9 (medium)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
c02511a0-9c8b-44cd-b25f-e95cf5f9fef3

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2024-07-09
Title
Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure
Published
2026-02-26
Title
WP Recipe Maker < 10.3.3 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter
Published
2024-08-21
Title
User Private Files < 2.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
Published
2023-06-27
Title
LearnDash LMS < 4.6.0.1 - User Account Takeover via Insecure Direct Object References
Published
2026-03-10
Title
ExactMetrics 8.6.0 - 9.0.2 - Insecure Direct Object Reference to Arbitrary Plugin Installation