CVE-2026-77786: Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability

Q: Which users can exploit this issue?

Users with the WordPress Editor role can modify site-wide core WordPress settings through the plugin's automated SEO fix functionality, even though those settings are normally restricted to administrators.

Q: What versions are affected?

Rank Math SEO versions before 1.0.277 are affected. The provided data does not identify a specific affected WordPress version range.

Q: What access does an attacker need?

An attacker needs an authenticated WordPress account with at least the Editor role and access to request an automated SEO fix through the plugin.

Published Aug 29, 2026

Updated

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.

Affected Software

1 affected component

WordPress plugin Rank Math SEO<1.0.277

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/rank-math-seo to a version that resolves this vulnerability.
Fixed in 1.0.277

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Users with the WordPress Editor role can modify site-wide core WordPress settings through the plugin's automated SEO fix functionality, even though those settings are normally restricted to administrators.

What versions are affected?

Rank Math SEO versions before 1.0.277 are affected. The provided data does not identify a specific affected WordPress version range.

What access does an attacker need?

An attacker needs an authenticated WordPress account with at least the Editor role and access to request an automated SEO fix through the plugin.

CVE-2026-77786: Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What versions are affected?

What access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What versions are affected?

What access does an attacker need?