CVE-2026-77782: Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

Q: Which sites are exposed to unauthenticated disclosure?

Sites using Rank Math SEO versions before 1.0.277.1 are exposed when password-protected post content is used to generate publicly available SEO metadata or llms.txt content.

Q: What does an attacker need to exploit this issue?

An attacker does not need to authenticate or know the post password. They need access to the publicly generated SEO metadata or llms.txt output that includes content from a password-protected post.

Q: What should be done if an immediate update is not possible?

The provided data does not identify a workaround. Treat password-protected post content as potentially exposed through Rank Math-generated public metadata or llms.txt until the plugin can be updated to 1.0.277.1 or later.

Published Sep 2, 2026

Updated

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.

Affected Software

1 affected component

Rank Math Rank Math SEO<1.0.277.1

Event History

Sep 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed to unauthenticated disclosure?

Sites using Rank Math SEO versions before 1.0.277.1 are exposed when password-protected post content is used to generate publicly available SEO metadata or llms.txt content.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate or know the post password. They need access to the publicly generated SEO metadata or llms.txt output that includes content from a password-protected post.

What should be done if an immediate update is not possible?

The provided data does not identify a workaround. Treat password-protected post content as potentially exposed through Rank Math-generated public metadata or llms.txt until the plugin can be updated to 1.0.277.1 or later.