Executive brief
Rank Math SEO, a popular WordPress plugin that optimizes website content for search engines, fails to respect password protection on posts and products. An unauthenticated attacker can view sensitive content from password-protected pages by examining the plugin's auto-generated metadata tags or by accessing the plugin's llms.txt file, bypassing the password protection entirely and exposing confidential information like payroll data or unreleased product details.
Technical details
The vulnerability is a sensitive data disclosure (CWE-200) in the Rank Math SEO WordPress plugin. The plugin generates publicly accessible SEO metadata (meta description, OpenGraph, and Twitter tags) and an llms.txt file from post/product content without checking password-protection status. An unauthenticated attacker can read protected content by viewing page source to inspect meta tags or requesting /llms.txt directly. Password protection is completely bypassed—no authentication is required. The vulnerability affects posts, WooCommerce products, and custom post types enabled in llms.txt. Fixed in version 1.0.277.1, though a WooCommerce-related leak persists through product metadata.
Affected products
- Rank Math Rank Math SEO before 1.0.277.1
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 1.0.277.1