What’s Vulnerable › Vulnerabilities
CVE-2026-77783: Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-02 · updated 2026-09-03
- Weakness: CWE-639
Description
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.
Affected products
- Rank Math SEO: from 1.0.48 before 1.0.277 — fixed in 1.0.277
How to fix
Upgrade to a fixed version: Rank Math SEO 1.0.277. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-77783 or the next vulnerability affects your stack