CVE-2026-77787: Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Rank Math SEOto a version that resolves this vulnerability.Fixed in 1.0.277
Event History
Frequently Asked Questions
Who can exploit this issue?
A WordPress user with the Author role or a higher-privileged role can exploit it. The issue does not require the user to have permission to edit the targeted taxonomy terms or posts.
What can an attacker change?
An attacker can modify SEO metadata for taxonomy terms they are not allowed to edit. They can also overwrite the titles of posts owned by other users through the bulk metadata update functionality.
Which versions are affected?
Rank Math SEO versions before 1.0.277 are affected. Upgrading to version 1.0.277 or later addresses the described vulnerable behavior.
How can administrators assess potential impact?
Review bulk metadata update activity for unexpected changes to taxonomy-term SEO metadata and post titles, especially changes associated with Author-level accounts. Check whether non-editorial users have accounts with Author or higher roles.