CVE-2026-77785 — Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its c…
Published: 2026-09-02 · CVSS: 2.7 · CVSS 3.1
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7